Tags: nextjs web 


*This is a walkthrough: straight from my mind step-by-step to the discord channel. Straight from discord to here:*


Should be easy (50 points, 146 Solves), is a web app written in next.js.


It's not like I understand much yet, but there is a `pages/api/hello.js` which references a `globalVars.SECRET`:

import globalVars from '../../utils/globalVars'

export default function handler(req, res) {
// res.status(200).json({ name: globalVars.FLAG })
res.status(200).json({ name: globalVars.SECRET })


http://my-first-web.balsnctf.com:3000/api/hello leads to a youtube video. Probably a rickroll

"name": "here is my secret: https://www.youtube.com/watch?v=jIQ6UV2onyI"


Nope. It's 10 hours of Nyan Cat instead. 1080p.
has 3'327'333 views so it is not a video with a flag hidden inside.

So it looks like we want globalVars.FLAG, not globalVars.SECRET


in `index.js` there is something accessing another globalVar:
<h1 className={styles.title}>
Welcome to {globalVars.TITLE}
so I figure we can access `globalVars.FLAG` in a similar way if we find a way to inject something somewhere.
I don't see where though.


`next.js` version seems up to date.

The `_app.js` looks pretty much like the default thing to do, as per [https://nextjs.org/docs/advanced-features/custom-app]( https://nextjs.org/docs/advanced-features/custom-app).


*A Team Member chimes in:*

> Reminds me of
> ![a challenge from a different ctf that used next.js too. It simply sent the secret along.](https://i.imgur.com/8bnvEIc.png)

lol wtf

but idk whether the flag is even in the pageProps. it is an imported global var

*I started looking at the client-side source now, instead of the server-side files.*


**flagged ✔**

I had a look at the Network tab and opened all the javascript files it loaded dynamically to look what they do. Some were minified, so I just searched for a part of the secret youtube link and did find it in http://my-first-web.balsnctf.com:3000/_next/static/chunks/pages/index-1491e2aa877a3c04.js - right next to all the other global variables

{default:function(){return l}});var d=c(5893),e=c(9008),f=c.n(e),g=c(5675),h=c.n(g),i=c(214),j=c.n(i),k={TITLE:"My First App!",SECRET:"here is my secret: https://www.youtube.com/watch?v=jIQ6UV2onyI",FLAG:"BALSN{hybrid_frontend_and_api}"};function l()