Hacker101 CTF: Micro-CMS v1 Part 4

Now the last part of this exercise, finding the fourth flag.

Until now, we've tried manipulating URL and the Title. We have not yet touched the body part in edit page. My guess is, this is the place where final flag should be. For this, I edited Markdown Test. There is "some button" where user definitely will click at first glance itself. Due to this reason, if we can manipulate this button to store script, it would be ideal for us.

Also, edit page clearly shows that "Markdown is supported, but scripts are not". This means we can make use of makdown in the body part to manipulate button. Let's look for different options to change the button behavior.

Doing some random testing and many hit-and-trial, I finally landed in this script

<button onclick=alert('Scripted')>Some Button</button>

Then hit save. Click on Some Button now. Alert message is generated so XSS attempt is successful. Even with this flag is not seen in the screen. But the good news is we already have the flag. 

I have developer tools always open and each time I make any change, I make sure to check on all elements, just in case there is a flag. And this time it was!