Бесконечность (Infinity)

Platform: bug-makers | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-29 | Status: Solved Techniques: server_side_eval, jsfuck_construction, alphanumeric_blacklist_bypass, type_coercion_infinity

Summary

Task: Express app asks for the password 'Infinity' but forbids all letters and digits and requires exactly 8 symbol-only characters; the backend eval()s the input and compares to Infinity. Solution: build a JSFuck-style 8-char expression +!![]/[] (== 1/0 == Infinity) to bypass the alphanumeric blacklist.

Бесконечность (Infinity) — bug-makers

Description

Бесконечность. Для получения флага введите пароль «Infinity».

English: "Infinity. To get the flag, enter the password «Infinity»."

Target: https://infinity.t1.bug-makers.ru

The goal is to make the server accept a value equal to Infinity, but the input must contain no letters or digits and must be exactly 8 characters long.

Analysis

The target is a Node.js / Express app (x-powered-by: Express). GET / renders a password form with these constraints: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

• minlength="8" and maxlength="8" — password must be exactly 8 characters.
• pattern="[^a-zA-Z0-9]*" with title "Запрещены буквы (a-z, A-Z) и цифры (0-9)" — letters and digits are forbidden, only symbols allowed.
• The form POSTs password to /check-password as application/x-www-form-urlencoded and parses a JSON response {success, message}.

Probing POST /check-password reveals the server enforces the same rules and evaluates the input as JavaScript:

Key insight: the literal string "Infinity" is rejected by the blacklist, yet the challenge insists on the value Infinity. The backend eval()s the submitted password and compares the result against the JavaScript number Infinity (i.e. Number("Infinity")). So we must build a symbol-only, exactly-8-character JavaScript expression that evaluates to Infinity — a classic JSFuck-style alphanumeric blacklist bypass.

Solution

Construct Infinity from 1 / 0, where both operands come from boolean/array type coercion using only !, [, ], +, /: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

• !![] → !!(empty array) → true
• +!![] → +true → 1
• [] → coerced to number 0
• 1 / 0 → Infinity

Winning payload (exactly 8 chars, no alphanumerics): +!![]/[]

 bash read-only • copy allowed Copy
curl -s -X POST https://infinity.t1.bug-makers.ru/check-password \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'password=+!![]/[]'

Response:

 json read-only • copy allowed Copy
{"success":true,"message":"BugCTF{REDACTED}"}

The flag confirms the technique: REDACTED (JSFuck; "Pixi3" references the background image /Pixie-Infinity.jpg). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍