# An alarming sight

| Info     | Details |
| -------- | ------- |
| Category | Web     |

## Challenge Overview

> This challenge presents us a webpage with a input form for analyzing temperatures and current from some satelites system. As we enter 'help' in the command sender we get that the only commands we're allowed are: status, clear, ping, capture. Nothing to do with a flag.

I tried inspecting the page source, to view if there are any cookies, fuzzing with tools like gobuster or dirsearch but nothing come up. Then I was pretty sure that we should get the flag using the command sender, with a command injection or something.

After some tries, we discovered a basic XSS STORED payload - `ping <img src=razvanttn onerror=alert(1)>` &#x20;

> You can check and try a lot of payloads using [XSS Cheat Sheets](https://github.com/payloadbox/xss-payload-list). This works not only with XSS Vulnerability, but also with SQLI, SSTI, and others.

After injecting it, we're told that we should exploit this vuln.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FwwAFwVJ6FQ3oEsXIa1e9%2FScreenshot_1.png?alt=media&#x26;token=1790e0f9-c605-45ff-8662-9270d284f995" alt=""><figcaption></figcaption></figure>

Trying the same payload on firefox browser is the solution, I don't know why, maybe skill-issue or it was something about the User-Agent.

## Final Flag

![](https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2F5fzQblunRgvTu4D0Vl7j%2Fscr2.png?alt=media\&token=fb58dcf3-e7b1-41c7-ab88-74cf9af9549a)

*made by k0d*
