Leek NFT challenge#0223 — Intigriti

Leek NFT challenge#0223 — Intigriti

Challenge Link: https://challenge-0223.intigriti.io/

Challenge By: https://twitter.com/x64pr0fessor

Goal: Now we understand that we need to find a method to display an alert box in order to confirm that this is indeed an instance of XSS.

Reconnaissance

We were given an application that allows us to create “Leek NFT” by uploading your own picture as background. After uploading the image you have to submit. You’ll see a message “file uploaded successfully to 355fed1f-a3ed-44cd-b708–93e1c6f2559a”. Where “355fed1f-a3ed-44cd-b708–93e1c6f2559a” is …

bug-bounty-writeup challenge ctf-writeup exiftool intigriti metadata nft stored xss