> For the complete documentation index, see [llms.txt](https://unsbotch.gitbook.io/unsbotch/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://unsbotch.gitbook.io/unsbotch/my-writeups/asis-ctf-2025-quals.md).
# ASIS CTF 2025 Quals
**web - Under the Beamers (unintended solution)**
In description we can see hint(or not) about dom clobbering attack with XSS (admin bot url).
First thing what i do before look at source code is just to check website blindly
We have a basic function is rendering our input, first of all we can check some html inputs like:
`bro`
and look is it rendering our input?
Simple html tags are working, but is XSS will work?
And XSS is working too, first thoughts in my mind was "it is just simple XSS challenge now i should just send payload to admin and steal cookie"
But after visiting admin bot link:
I understood that there is no simple link input form for payload url, and started analyzing responce
First thing i did is just look at which url admin got from us
Then i looked at source code of bot:
There is same parameter "url" which accept html code
If we looked again at request we can see that parameter html has a "GET" value, we need to just input XSS payload instead of our GET request
But yes, it will not work because of check on `!html` i spent some time for bypass restrictions, like as admin bot look at all headers, i also tried to paste payload at headers, until i realized we need to check only `?html` parameter, after i again looked at full code for finding sinks for DOM Clobbering attack, but didn't find anything.
After some times i noticed:
`Every console.log usage on the bot will be sent back to you :)`
`will be sent back you` - this is what we need
Our request was reflected from admin:
As it turned out by Mizu message it was unintended solution, so accoroding to task name description i guess in intendend solution we had to use clobber something and exploit bypass restrictions to do XSS in `?html` tag.
**web - ScrapScrap 1**
At this chall we did a second blood
As always after reading description of task, we dive into testing web-site blindly
At the main page we have default register and login menu create account and log in
After log in we redircted in `/checker` endpoint paste a random website we get responce:
`Your website can definitely be scrap, be careful...`
After some attempts to do SSRF like:
`file:///etc/passwd, http://127.0.0.1` and SQLi in login and register forms, i decided to check source code
A lot of files, but I immediately noticed an interesting one "scrap.ejs" because on the web-site we didnt see this endpoint, and the challenge is calling "ScrapScrap"
So as you can see, in the code logic: if you visit endpoint `/scrap` and your username is not `superbot` you will get the flag