CrewCTF 2025 - Love Notes
TL;DR: Stored XSS bypassing the CSP via a raw HTTP response endpoint, chained with a meta-refresh redirect to hijack the admin bot
CrewCTF 2025
A CTF organized by the Crew team.
TL;DR: Stored XSS bypassing the CSP via a raw HTTP response endpoint, chained with a meta-refresh redirect to hijack the admin bot