This was a challenge to demonstrate how the content-type header can be used to fool the browser into treating the HTTP response body in unexpected ways.
As the harder solution works for both, heres source:
php
avlidienbrunn
/ writeup.md
Created
September 18, 2023 16:18
challenge writeup content-type shenanigans
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| B=({A..Z} {a..z} {0..9});p=printf\ ;I=$(B=$@ | |
| for((;i<${#B};i++)){ for y in {31..128};{ | |
| [[ ${B:i:1} = "$($p\\x`$p%x $y`)" ]]&&(a()((q=y/2,r=y%2));a;o=$r | |
| for((;q;)){ y=$q;a;o=$r$o;};$p%08d $o)} }) | |
| for((;e<${#I};e+=6)){ y=${I:e:6}0000;O+=${B[2#${y::6}]};} | |
| for((;${#O}%4;)){ O+=\=;} | |
| $p$O |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Afghanistan | |
| Albania | |
| Algeria | |
| Andorra | |
| Angola | |
| Antigua & Deps | |
| Argentina | |
| Armenia | |
| Australia | |
| Austria |