# Zeyu's Infosec Blog 👋 This is where I write about information security! ## \~# whoami I love to build and break things. Cybersecurity is one of the many fields I'm passionate about. You can learn more about me from my [personal website](https://www.zeyu2001.com/). ## \~# ls -la 2023 ### [DEF CON 31 CTF && Midnight Sun CTF Finals 2023](/2023/def-con-31-ctf-and-and-midnight-sun-ctf-finals-2023) My first hacker summer camp experience 🏖️ ### [From XS-Leaks to SS-Leaks Using object](/2023/from-xs-leaks-to-ss-leaks) Turning cross-site leaks (XS-Leaks) into "same-site leaks" using the object element to get around SameSite cookies. Nested objects, lazy loading and responsive images help us to conditionally perform callbacks based on HTTP response status codes. ### [Regular Expressions Are Hard](/2023/regular-expressions-are-hard) From insufficient security fixes to ReDoS, regular expressions are hard to get right. Yet, they are integral to modern software security and development. Hopefully this article helps you avoid common pitfalls before it's too late! ### [ReadiumJS Cloud Reader — Everybody Gets an XSS!](/2023/readiumjs-cloud-reader-everybody-gets-an-xss) While participating in a bug bounty programme, I stumbled upon a (surprisingly, somewhat known) XSS vulnerability in the Readium cloud reader that affects many university websites and online libraries. ## \~# ls -la 2022 ### [HTTP Request Smuggling in the Multiverse of Parsing Flaws](/2022/http-request-smuggling-in-the-multiverse-of-parsing-flaws) HTTP request smuggling is a vulnerability which arises when web servers and proxies interpret the length of a single HTTP request differently. While basic techniques have been known since 2005, renewed research interest in HTTP request smuggling in recent years have uncovered many new bugs in popular web proxies and servers. Nowadays, novel HTTP request smuggling techniques rely on subtle deviations from the HTTP standard. Here, I discuss some of my recent findings and novel techniques. ### [Hosting a CTF — SEETF 2022 Organizational and Infrastructure Review](/2022/hosting-a-ctf-seetf-2022-organizational-and-infrastructure-review) My experience in hosting SEETF 2022, and lessons learnt. SEETF is a cybersecurity Capture the Flag competition hosted by the Social Engineering Experts CTF team. We were pleased to host our inaugural competition in 2022, which saw over 2,000 participants and 1,200 teams. Of these teams, 740 solved at least one challenge. # DEF CON 31 CTF && Midnight Sun CTF Finals 2023 My first hacker summer camp experience 🏖️

Photoshop and weeb credits to Perfect Blue

This past month, I travelled to 3 countries: USA, Germany, and Sweden. I participated in the **DEF CON 31 CTF finals** with my team, **Blue Water** (a collaboration between Perfect Blue, Water Paddler, Samsung Research, Tea Deliverers, and Georgia Tech SSLab), and **Midnight Sun CTF** with a Singaporean team, **ThreeTop Walk**. This post serves as proof that I touched grass along the way. ## Los Angeles Flights from Singapore directly to Vegas were expensive. However, an open secret is that booking two separate flights for SIN-LAX and LAX-LAS (instead of a single booking with a layover) is a much cheaper option. This was the obvious choice for me, allowing me to visit a different state while not feeling bad about taking too much money from the team funds. I decided to arrive in the US slightly earlier to get rid of jetlag by the time the CTF comes around, so I stayed in LA for 3 days before going to Vegas. When I was booking my flights, the cheapest option was [STARLUX](https://www.starlux-airlines.com/en-Global), a new-ish Taiwanese airline. Interestingly enough, the economy class seats ran out, but the premium economy tickets were still *cheaper* than the economy options of other available flights. ### STARLUX Airlines Before I knew it, I was on my way to LAX! This journey consisted of a relatively short flight to Taipei, Taiwan, followed by a long flight to the US. I was no stranger to long-haul flights, but this was honestly *the* best experience I ever had with any airline. I was able to choose my seat (for free!) and I got an aisle seat at the very front of the plane for both flights. The seats were super comfortable and there was a lot of legroom. Being literally the first person in economy class to get off both flights was also super cool.

The entertainment screens were also very high-resolution, and the service was great!

Looking back, this did not feel like premium economy at all. I know which flight I'm taking next time! ### Taiwan Layover I had a 4-hour layover at Taoyuan International Airport in Taiwan. I had some chicken rice and played a random CTF to pass the time.

### LA at Last I was staying at an Airbnb in Anaheim. It was super cozy and instagrammable, but far from Hollywood and other tourist attractions in LA - it was $50 to get an Uber to Hollywood Boulevard. Looking back, lower Uber costs might have made up for the cost of a more expensive Airbnb closer to where things are.

### Hollywood Boulevard On my first day, I met up with some Water Paddler teammates and watched Oppenheimer at [TCL Chinese Theatres](https://www.tclchinesetheatres.com/)! It was my first time watching IMAX in a very long time, and the movie definitely didn't disappoint.

After the movie, we walked around the boulevard and had lunch. Then we almost walked into a Church of Scientology building for a free personality test, but some people chickened out.

We then went to visit [University of Southern California (USC)](https://www.usc.edu/), where some of my teammates were studying. USC was one of the schools that I was unfortunately rejected from, so it was interesting to visit what "could have been". The school also has a "CTF" building which was pretty funny.

### Universal Studios Hollywood The next day, we visited [Universal Studios](https://www.universalstudioshollywood.com/web/en/us/). My favourite part of the theme park was the Studio Tour, where you get to visit actual sets used to shoot movies and TV shows. The Harry Potter and Super Mario areas were also super fun as usual. My only complaint was that the weather was way too hot! Thankfully, there were many indoor rides to escape the heat.

In the evening, we checked out Venice Beach and [Santa Monica Pier](https://www.santamonicapier.org/). There was a skate park at Venice Beach where people were doing cool tricks, which I honestly wouldn't mind watching for hours!

## Las Vegas You know you're in Vegas when there are slot machines *at the airport.*

### Horseshoe I arrived 2 days before the start of DEF CON, so that I could explore Vegas a little. For these two days, I stayed at [Horseshoe](https://www.caesars.com/horseshoe-las-vegas/hotel), before moving over to [Harrah's](https://www.caesars.com/harrahs-las-vegas/hotel) with my team. My hotel window had a perfect view of the newly-built Las Vegas Sphere!

### Escape Room On my first day here I met up with a couple of Water Paddler teammates again, and we went to an escape room. We had to fill out a waiver form on these kiosks, which we managed to escape using keyboard shortcuts. For some reason, the first keyboard shortcut that came to my mind was Windows-L which locks the screen, so my friend ended up doing just that...

We also went on a roller coaster at the same hotel. Unfortunately I don't have any photos of that, as we had to store our phones in a locker. It was definitely way better than what I expected when I initially heard "hotel roller coaster" - 360 degree loops, insane drops and a great view of the strip! ### Cloudflare Party That night we went for a party hosted by Cloudflare. Technically we needed a Black Hat pass in order to get into the party, but so many people tried to get in without one (with various excuses) that they ended up letting us in anyway.

### DEF CON Thankfully, I bought the pre-registration ticket online before they ran out, so I had a relatively shorter queue to collect my DEF CON badge. The badge this year was not electronic, which was slightly disappointing. While standing in LINECON, I got some googly eyes from a stranger.

We also made sure the Water Paddler sticker had its place on the sticker wall!

### DEF CON CTF Things come and go but I will never be 21 and whining about CTF infrastructure from a luxury suite with my teammates again. This year we played the DEF CON CTF from a suite in the [The Palazzo at The Venetian Resort](https://www.venetianlasvegas.com/towers/the-palazzo.html). It was definitely an insane experience seeing a suite like this for the first time - you could easily get lost in here trying to find the washroom.

There was also a Steinway & Sons piano that played itself!

Overall, I found the CTF to be a fun experience. There were (surprisingly) two web challenges in the finals, although both involved some reverse engineering. This year, services did not retire, meaning that we had to work through the night on both day 1 and 2. Challenges were also being released at the end of each day, so it was a race against the clock to see which teams did the most "homework" when the next tick came around the following morning. The infrastructure was also allegedly better than last year, and survived the full 3 days of CTF. Unfortunately, there was a hiccup on day 2, where some teams (including us) could not run any attacks due to a container limit misconfiguration. I realised just how different team sizes were across the finalists - we were around 20-30 people strong, which was probably lower than average. We really started to feel it as the CTF progressed and services didn't retire. By the end of the CTF, some challenges only had 2 to 3 people working on them. Overall, I think 2nd place was a really great result for us, considering the strong competition we were up against. ### Afterparty CTF players really throw the best parties. I had a lot of fun talking to CTF players and people in the industry, matching Twitter and Discord handles to real life faces. It's a pity that I had a flight the next day, or I definitely would have stayed for longer.

## Munich The next stop was Midnight Sun CTF with ThreeTop Walk, but we had a few days before we had to arrive at Stockholm. We've transited at Munich many times before when travelling to European countries from Singapore, but never had a long enough layover to visit the city. We decided that this was the perfect opportunity to explore the city for a few days. ### Marienplatz Marienplatz is the "main" city square of Munich. For a small fee, you could go up the tower and get a great view of the city.

### Nymphenburg Palace This was a really beautiful palace, with museums and a rich history. The weather was very hot so we didn't spend too much time outside, but the gardens were also very beautiful!

## Stockholm After two weeks of scorching heat in LA, Vegas, and Munich, Stockholm's cool weather was a nice escape. On the day before the CTF, the organisers treated us to a free dinner and drinks. Everything was paid for from 6.00pm to 7.00pm - as CTF players, of course we exploited this and ordered a bunch of extra drinks at 6.59pm. ### Midnight Sun CTF The CTF venue for Midnight Sun CTF is one of the best of any onsite CTF I've participated in. There is a central lunch venue with team banners hung up on the wall, and each team had a private room to work in. The central conference hall was also the venue for the live 1v1 pwn competition, which was similar to DEF CON's LiveCTF.

The CTF was pretty cool overall. There were also "speed" challenges - the first three teams to solve these challenges got bonus points. The speed challenges this year comprised of all four categories - web, pwn, reversing, and crypto. ### Afterparty As usual, the afterparty was great! After the afterparty, we also went to a restaurant & bar where I finally had some Swedish meatballs, and an arcade where I had lots of fun with the racing games.

## Back to Real Life Finally, after a 2-week CTF world tour, it was time to go home. We managed to find a really cheap flight back to Singapore with Qatar Airways. I had a layover at Doha airport, which interestingly looked a lot like Jewel at Changi Airport.

This was honestly the most fun I've had in all my CTF trips so far, with Romania earlier this year not too far behind. For a few days after I was back, it was really weird returning to real life, and I've only just fully tuned my body clock back to the Singapore timezone. To be honest, I'm not sure if I will return for the CTF next year. Something I really regret was not being able to attend any of the DEF CON talks and activities because I was too busy with the CTF. Maybe next year I will come earlier to attend Black Hat, or just skip the CTF altogether to attend the actual DEF CON conference. At the same time, playing the CTF with my teammates was also super fun, and hopefully we have a chance at 1st place next year. In any case, it was super cool to finally meet my teammates in person and I'm looking forward to Hacker Summer Camp 2024, regardless of whether I'm playing the CTF. # From XS-Leaks to SS-Leaks Using object Using nested objects, lazy loading and responsive images to leak data

Nowadays, [cross-site leaks (XS-Leaks)](https://xsleaks.dev/) are often limited by *SameSite* settings. This is because XS-Leaks rely on a malicious page being able to send a victim's cookies to a cross-site target in order to infer the victim's state.

Many XS-Leak techniques rely on being able to fetch a resource through *non*-top-level navigations, such as an `iframe` element, `script` element, or `fetch()` request. However, *SameSite: Lax* cookies will only be sent on top-level navigations, i.e. navigations that change the URL in the browser's address bar. This means that for most techniques, *SameSite: Lax* cookies are an effective defence. Of course, this does not include the man*y* classes of XS-Leaks that still work with top-level navigations such as `window.open` popups. But for practical purposes, this stops a lot of XS-Search attacks. For instance, consider a scenario where an API returns a 200 status code response if results match a given search query, and a 404 status code otherwise. This is behaviour that one might expect from a search API — for example, on a social media site, being able to leak status codes could mean the ability to leak private posts, friends, and contacts. If the cookies were *SameSite: None*, stealing data would be trivial: 1. Create a `script` element, and set its `src` to the cross-origin target URL. `https://target.com/api/search?query=secret`. 2. Define an `onload` handler and an `onerror` handler for the script. 3. Finally, insert the `script` element into the DOM. 4. If the target URL returns a 200 status code, the `onload` handler is executed. Otherwise, the `onerror` handler is executed. 5. Repeat steps 1 to 4, brute-forcing the search query character by character until the secret is extracted. However, if *SameSite: Lax* cookies were used, this attack would not be possible. This is quite a big problem, since Chromium has been enforcing lax-by-default since 2020. More recently, Firefox also rolled out [Total Cookie Protection](https://blog.mozilla.org/en/mozilla/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/), which blocks cross-site cookies through subresources by default. These defences pose the question: is there a way to turn "cross-site" leaks into "same-site" leaks? ## SS-Leaks? Suppose we have some HTML injection on a target application. Because of restrictive CSP or sanitization, XSS is not possible. Can we still leak information about the victim? There are techniques such as dangling markup injection for leaking content from the same URL, but what if we want to leak data from another URL, such as an API endpoint? Furthermore, modern client-side sanitisers ensure that the resulting HTML is well-formed — how do we leak data then? Consider the above scenario where we want to leak 200 vs 404 status codes. Now we have *SameSite: Lax* cookies, but an HTML injection on a same-site page. Our goal is to leak whether this API endpoint returns a 200 or 404 status code. ```javascript app.get('/api/v1/leaky', (req, res) => { if (SECRET.startsWith(req.query.secret)) { res.status(200).send('Yes'); } else { res.status(404).send('No'); } }); ``` ## Object Leaks The `