# sbva, Web, 110pts
## Problem
We offer extensive website protection that stops attackers even when the
admin's credentials are leaked!
Try our demo page http://0da57cd5.quals2018.oooverflow.io with
username:password [email protected]:admin to see for yourself.
## Solution
It was a quite tricky challenge, which looks somehow difficult at the
beginning. The only thing we've got was a simple login form and when I've put
credentials provided, I immediately stuck with the page said that
```Incompatible browser detected.``` (served by the file named
```wrongbrowser.php```)
So it was clear that solution is somewhere around User-Agent string.
First thing I've tried was some simple XSS and SQLi payloads, like typical
_skiddie_, with expected result (I mean - no result at all). The next try was
to get rid off User-Agent completely:
Then I've realized the fact that this weird HTML has to be some clue:
```html
```
Why such weird "page" was put into something which the only thing to do was to
redirect to ```wrongbrowser.php```?
And why this code checks if my battery is charging?
Wait a second... ```navigator.battery``` is not supported already in many
browsers or its newer API ```navigator.getBattery()``` should be used. And why
the hell someone used ```scoped``` attribute for ```