#xss — Godson's Blog

Tagged: #xss

6 writeups

Client-Side / XSS

CTF Author Writeup

March 2023 - Intigriti's XSS Challenge - Author Writeup

Due to time constraints I never delivered a full write-up for my own March 2023 Intigriti challenge, so here are links to the community write-ups plus a short summary of the intended path-traversal and cache-based CSP bypass.

#ctf #xss #intigriti #csp-bypass

Jul 27, 2025 · 2 min read

Client-Side / XSS

CTF Author Writeup

Intigriti's Nov XSS Challenge Writeup

This is an XSS challenge on a note-taking application. The goal is to take over the admin's account, which has the flag in it — by abusing Varnish caching to smuggle an XSS past a strict CSP.

#ctf #xss #intigriti #varnish

Nov 12, 2022 · 5 min read

Client-Side / XSS

📌 PinnedCTF Author Writeup

Intigriti's October 2022 - XSS Challenge Author Writeup

This month, I created a hard XSS challenge for Intigriti that ended up with only one official solve — a chain through IP-spoofing, cookie tossing, prototype pollution, and dangling markup to leak a CSP nonce.

#ctf #xss #intigriti #prototype-pollution #csp-bypass

Oct 24, 2022 · 24 min read

Chained Exploit

CTF Writeup

B-XSS -> ZipSlip -> Local File Read

A Cyber Apocalypse CTF 2022 web challenge chaining a blind XSS in an admin report-review page into a ZipSlip symlink attack on a firmware-upload endpoint to read /flag.txt off the server.

#ctf #xss #zipslip #python

May 23, 2022 · 9 min read

Client-Side / XSS

CTF Writeup

May 2022 - Intigriti XSS Challenge Writeup - Prototype Pollution to Overwrite XSS filters!!!

A client-side prototype pollution in an old jQuery.query plugin lets us reach into the js-xss library's internal whiteList object and rewrite its own sanitization rules from the outside, turning a filtered innerHTML sink into a clean DOM XSS.

#ctf #xss #prototype-pollution #intigriti

May 3, 2022 · 22 min read

Client-Side / XSS

CTF Writeup

Abusing URL Parser for XSS

A TamilCTF challenge reflects a parsed URL's hostname unescaped into an error message. A Node.js hostname-validation CVE lets HTML tags survive as a hostname, and a form-feed injection payload turns that into working XSS against the admin bot.

#ctf #xss #nodejs #cve

Mar 28, 2022 · 4 min read