whoami activities projects
back to activities
shopping1
OSINT · Diver OSINT CTF · 2026

Challenge Description

Users of an e-commerce website reported that the credit card information they had registered on the site appeared to have been leaked. Part of the website had been tampered with.

The task was to identify the GitHub account publishing the source code of the library being abused as the distribution source. 

Target: https://shop.attic-findings.com/
Flag format: Diver26{account}

Step-by-Step Solution

Step 1: Monitor Fetch Requests

I opened the browser developer console and replaced window.fetch with a wrapper that printed the request and paused execution. 

const originalFetch = window.fetch;

window.fetch = function (...args) {
    console.trace("FETCH CALLED:", ...args);
    debugger;
    return originalFetch.apply(this, args);
};

I then submitted the checkout form using the dummy card details provided by the site.

Step 2: Identify the Normal Checkout Request

The fetch wrapper captured this request:

POST https://shop.attic-findings.com/thanks

The request body contained the checkout information:

first_name=Test&last_name=User&email=hello%40attic-findings.invalid&phone=%2B1+555-0100&card_number=4111+1111+1111+1111&card_expiry=12%2F34&card_cvc=123

The call stack showed that the request came from the site's checkout script:

fetch
    https://shop.attic-findings.com/assets/checkout.js:17
    https://shop.attic-findings.com/assets/checkout.js:11
    https://shop.attic-findings.com/assets/checkout.js:7
    https://shop.attic-findings.com/assets/checkout.js:37

This looked like the normal checkout process because the request was being sent to the same website's /thanks page.

Step 3: Monitor sendBeacon

Since the first request did not explain the leak, I also monitored navigator.sendBeacon(). 

const originalBeacon = navigator.sendBeacon.bind(navigator);

navigator.sendBeacon = function (url, data) {
    console.trace("BEACON CALLED:", url, data);
    debugger;
    return originalBeacon(url, data);
};

I submitted the checkout form again.

Step 4: Find the Exfiltration Request

The beacon wrapper captured a second request:

BEACON CALLED: https://js-deliver.com/upload

The data sent to the endpoint contained the original checkout request:

{
  "u": "https://shop.attic-findings.com/thanks",
  "m": "POST",
  "b": "first_name=Test&last_name=User&email=hello%40attic-findings.invalid&phone=%2B1+555-0100&card_number=4111+1111+1111+1111&card_expiry=12%2F34&card_cvc=123",
  "t": 1785048345512
}

The checkout information was being copied and sent to js-deliver.com/upload while the normal checkout request continued.

Step 5: Inspect the Call Stack

The call stack for the beacon request showed:

sendBeacon
    _0xaddce https://js-deliver.com/v2/polyfill.min.js:1
    eUpvq https://js-deliver.com/v2/polyfill.min.js:1
    <anonymous> https://js-deliver.com/v2/polyfill.min.js:1
    fetch
    <anonymous> https://shop.attic-findings.com/assets/checkout.js:17

The script responsible for intercepting the request was:

https://js-deliver.com/v2/polyfill.min.js

The file appeared to be a normal minified polyfill, but it was intercepting the site's fetch request and sending a copy of the checkout data elsewhere.

Step 6: Trace the Library to GitHub

The js-deliver.com project linked to the following GitHub repository: 

https://github.com/smpri194-beep/js-deliver

The GitHub account publishing the source code was:

smpri194-beep

Flag

Diver26{smpri194-beep}

Conclusion

The malicious polyfill.min.js script intercepted the site's normal checkout request and sent the payment information to js-deliver.com/upload. The source code was published by the GitHub account smpri194-beep.

cyberfigtree.dev