done bff

Author: ret2jazzy

2022/seccon-quals-2022/bff/README.md

@@ -0,0 +1,15 @@
+# bff
+
+Here's how the progression went:
+
+![](./p1.png)
+![](./p2.png)
+
+Expanded burp image:
+
+
+![](./p3.png)
+
+Final was just smuggling another http request with the cookie as part of the `expr` post data
+
+![](./p4.png)