[Defenit CTF 2020] babyjs write-up

The challenge provides server js code. It uses nodejs.

if (typeof content === 'string' && content.indexOf('FLAG') != -1 || typeof content === 'string' && content.length > 200) {
	res.end('Request blocked');
	return;
}

It use hbs as template engine. If I submit the syntax {{apple}}, it returns 'mint'.

 

With similar step, I we can submit the syntax {{FLAG}}, it will return the flag.

But the middleware of express engine filter the "FLAG" keyword with string type.

Then we can submit with array type.

With burp suite, use paramter key content[] instead of contet.

With chrome dev tools, replace the name content to content[]

In addition, this solution is unintended solution.