päääd - Hack.lu CTF 2023
2024-05-26 | #writeups
tl;dr
- meta redirect to attacker website, using the html injection in the paaad.
- leak the unique subdomain with csp violation.
- Another meta redirect csrf with the leaked subdomain to make the note public.