Noogle - web | ar1fshaikh

Challenge description: Last week I decided to create my own search engine. It was kinda hard so I piggybacked on another one. I also tried something on port 8000.

When I opened the challenge instance, I was greeted with a minimal search page that looked suspiciously familiar. Meet Noogle.

Noogle-Intro

It looks like a normal landing page, but submitting a query didn’t do anything.

So I inspected the page source.

Noogle-inspected

The UI was fine, so the next stop was the client-side script: search-query.js.

Javascript deobfuscation

Here’s the file as served (obfuscated):

1
const _0x43a57f = _0x22f9;
25 collapsed lines
2
(function(_0x3d7d57, _0x426e05) {
3
    const _0x16c3fa = _0x22f9
4
      , _0x318780 = _0x3d7d57();
5
    while (!![]) {
6
        try {
7
            const _0x52f259 = -parseInt(_0x16c3fa(0x11d)) / 0x1 * (-parseInt(_0x16c3fa(0x10c)) / 0x2) + -parseInt(_0x16c3fa(0x11c)) / 0x3 + parseInt(_0x16c3fa(0x11b)) / 0x4 + parseInt(_0x16c3fa(0x120)) / 0x5 + -parseInt(_0x16c3fa(0x119)) / 0x6 + parseInt(_0x16c3fa(0x107)) / 0x7 + parseInt(_0x16c3fa(0x10e)) / 0x8;
8
            if (_0x52f259 === _0x426e05)
9
                break;
10
            else
11
                _0x318780['push'](_0x318780['shift']());
12
        } catch (_0x409286) {
13
            _0x318780['push'](_0x318780['shift']());
14
        }
15
    }
16
}(_0x1be0, 0x9799d),
17
document[_0x43a57f(0x116)](_0x43a57f(0x10d), function() {
18
    const _0x55ef70 = _0x43a57f;
19
    document[_0x55ef70(0x114)](_0x55ef70(0x11a))[_0x55ef70(0x116)](_0x55ef70(0x111), function(_0x3cfad3) {
20
        const _0x4605e1 = _0x55ef70;
21
        _0x3cfad3['preventDefault']();
22
        const _0x44eac5 = _0x4605e1(0xff) + document['getElementById'](_0x4605e1(0x122))[_0x4605e1(0x115)];
23
        document[_0x4605e1(0x114)](_0x4605e1(0x110))['innerHTML'] = '',
24
        sendData(_0x44eac5);
25
    });
26
}));
27
function sendData(_0x12b935) {
28
    const _0x109fde = _0x43a57f;
29
    fetch('/api/getLinks', {
30
        'method': _0x109fde(0x10f),
31
        'headers': {
32
            'Content-Type': _0x109fde(0x103)
33
        },
34
        'body': JSON['stringify']({
35
            'url': _0x12b935
36
        })
37
    })[_0x109fde(0x112)](_0x18bc0d => {
38
        const _0x36b6b9 = _0x109fde;
39
        if (!_0x18bc0d['ok'])
40
            throw new Error(_0x36b6b9(0x113));
41
        return _0x18bc0d[_0x36b6b9(0x106)]();
42
    }
43
    )[_0x109fde(0x112)](_0x7dd058 => {
44
        const _0x1611a0 = _0x109fde
45
          , _0x226a83 = new DOMParser()
46
          , _0x3f7bbe = _0x226a83['parseFromString'](_0x7dd058, _0x1611a0(0x109))
47
          , _0x5d877b = _0x3f7bbe['querySelectorAll']('a')
48
          , _0x296887 = _0x3f7bbe[_0x1611a0(0x11e)]('h3')
49
          , _0x2de64a = [];
50
        _0x5d877b[_0x1611a0(0x108)](_0x197c31 => {
51
            const _0x3b394d = _0x1611a0;
52
            try {
53
                const _0xdc782 = _0x197c31[_0x3b394d(0x105)]('href');
54
                _0xdc782[_0x3b394d(0x100)](_0x3b394d(0x118)) && _0x197c31[_0x3b394d(0x105)](_0x3b394d(0x117))[_0x3b394d(0x100)]('2ahUKE') && _0x2de64a[_0x3b394d(0x104)](_0xdc782);
55
            } catch (_0x448110) {}
56
        }
57
        ),
58
        Promise[_0x1611a0(0x102)]([_0x2de64a, _0x296887])['then']( ([_0x436123,_0x1d19c4]) => {
59
            const _0x1a11e5 = _0x1611a0;
60
            for (let _0x20c585 = 0x0; _0x20c585 < _0x5d877b[_0x1a11e5(0x121)] && _0x20c585 < _0x1d19c4[_0x1a11e5(0x121)]; _0x20c585++) {
61
                const _0x250c42 = _0x436123[_0x20c585]
62
                  , _0x364137 = _0x1d19c4[_0x20c585]['textContent']['trim']();
63
                document['getElementById'](_0x1a11e5(0x110))[_0x1a11e5(0x101)] += _0x1a11e5(0x11f) + _0x250c42 + '\x22>' + _0x364137 + _0x1a11e5(0x10a);
64
            }
65
        }
66
        );
67
    }
68
    )['catch'](_0x47beb6 => {
69
        const _0x35dd36 = _0x109fde;
70
        console['error'](_0x35dd36(0x10b), _0x47beb6);
71
    }
72
    );
73
}
74
function _0x22f9(_0x4bc5ac, _0x2b5e49) {
75
    const _0x1be057 = _0x1be0();
76
    return _0x22f9 = function(_0x22f90e, _0x3b583c) {
77
        _0x22f90e = _0x22f90e - 0xff;
78
        let _0x1e0f27 = _0x1be057[_0x22f90e];
79
        return _0x1e0f27;
80
    }
81
    ,
82
    _0x22f9(_0x4bc5ac, _0x2b5e49);
83
}
84
function _0x1be0() {
85
    const _0x5e3c7c = ['</a><br>', 'Error:', '12bqpdPx', 'DOMContentLoaded', '523808pUNNLD', 'POST', 'response', 'submit', 'then', 'Network\x20response\x20was\x20not\x20ok', 'getElementById', 'value', 'addEventListener', 'data-ved', 'url', '5955222CsWYxv', 'search-form', '2372928EQZrlc', '2500197shtdfI', '138601QPPhqz', 'querySelectorAll', '<a\x20href=\x22https://www.google.com', '1699145xzyuVK', 'length', 'search-item', 'https://www.google.com/search?q=', 'includes', 'innerHTML', 'all', 'application/json', 'push', 'getAttribute', 'text', '4317250nbyqNF', 'forEach', 'text/html'];
86
    _0x1be0 = function() {
87
        return _0x5e3c7c;
88
    }
89
    ;
90
    return _0x1be0();
91
}

After deobfuscating (not necessary), the interesting part boiled down to this:

1
function sendData(_0x12b935) {
2
    const _0x109fde = _recursionfunction;
3
    fetch('/api/getLinks', {
4
        'method': 'POST',
5
        'headers': {
6
            'Content-Type': 'application/json'
7
        },
8
        'body': JSON['stringify']({
9
            'url': _0x12b935
10
        })
11
    })['then'](res => {
12
        const _0x36b6b9 = _0x109fde;
13
        if (!res['ok'])
14
            throw new Error(_0x36b6b9(0x113));
15
        return res['text']();
16
    }
17
    )['then'](_0x7dd058 => {
18
        const _0x1611a0 = _0x109fde
19
          , _0x226a83 = new DOMParser()
20
          , _0x3f7bbe = _0x226a83['parseFromString'](_0x7dd058, 'text/html')
21
          , _all_a = _0x3f7bbe['querySelectorAll']('a')
22
          , _all_h3 = _0x3f7bbe['querySelectorAll']('h3')
23
          , _0x2de64a = [];
24
...

So the key endpoint is:

curl --path-as-is -i -s -k -X $'POST' \
    -H $'Host: host' -H $'Content-Length: 45' -H $'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36' -H $'Content-Type: application/json' -H $'Accept: */*' -H $'Sec-GPC: 1' -H $'Accept-Language: en-US,en;q=0.5' -H $'Origin: http://34.141.76.145:31119' -H $'Referer: http://34.141.76.145:31119/' -H $'Accept-Encoding: gzip, deflate, br' -H $'Connection: keep-alive' \
    --data-binary $'{\"url\":\"https://www.gogle.com/search?q=test\"}' \
    $'http://host/api/getLinks'

The server fetches the provided URL and the client parses the returned HTML, pulling results out of Google’s response.

Playing around

Google-Response

When I started testing variations of the url parameter, I got a 400 Invalid URL with all type of variations. For example:

It looked like the backend was enforcing a strict prefix: "https[:]//www[dot]google[dot]com/<anything>". At this point I was stuck for a while, digging around for ways to stay within that constraint.

I already knew about a few Google open-redirect patterns, but many of them now land on a warning page:

google-redirection

Then I remembered something from email links: they’re often wrapped and include a data-saferedirecturl attribute (plus some extra parameters) pointing to the real destination.

Email-Inspect

I dropped that wrapped link into the url parameter, and that did it. The response contained the flag.

Flag

Learnings

Strict URL allowlists are not a guarantee: if the server fetches URLs for you, the exact parsing rules matter a lot.
Look for legitimate redirect wrappers: sometimes the “allowed” domain already contains a safe-looking way to reference an external target.