6 min read
BITSCTF 2026 — SafePaste Writeup
A paste site sanitizes with DOMPurify and then feeds the result to String.prototype.replace: the $& and $` replacement patterns smuggle a live iframe past the sanitizer, and a /hidden-scoped flag cookie is read through a same-origin 404 frame.
#CTF#Cybersecurity#Web