Due to time constraints I never delivered a full write-up for my own March 2023 Intigriti challenge, so here are links to the community write-ups plus a short summary of the intended path-traversal and cache-based CSP bypass.
This is an XSS challenge on a note-taking application. The goal is to take over the admin's account, which has the flag in it — by abusing Varnish caching to smuggle an XSS past a strict CSP.
This month, I created a hard XSS challenge for Intigriti that ended up with only one official solve — a chain through IP-spoofing, cookie tossing, prototype pollution, and dangling markup to leak a CSP nonce.
A client-side prototype pollution in an old jQuery.query plugin lets us reach into the js-xss library's internal whiteList object and rewrite its own sanitization rules from the outside, turning a filtered innerHTML sink into a clean DOM XSS.
