Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Go to file
Ronnie Flathers move to js folder
Latest commit 460e0db Sep 27, 2020 History
0 contributors

Users who have contributed to this file

<html>
<head>
<script src="js/helperFunctions.js"></script>
</head>
<body>
<div>
<button id="login" onclick=login()>Login and get new token</button>
<br />
<code id="loginResponse"></code>
</div>
<hr />
<div>
<button id="makeRequest" onclick=makeRequest()>Make an "authenticated" request</button>
<br />
<code id="requestResponse"></code>
</div>
<hr />
<div>
<textarea rows=3 cols=100
placeholder="Enter JS to execute on this page (simulate XSS). Can you retrieve the auth token?"
id="payload"></textarea>
<br />
<button id="execute" onclick=execute()>Execute</button>
</div>
<hr />
<div>
<button onclick=clearCookies()>Clear Cookies</button>
<button onclick=clearGlobalVar()>Clear global variable</button>
<button onclick=clearLocalStorage()>Clear localStorage</button>
<button onclick=clearSessionStorage()>Clear sessionStorage</button>
<br />
<code id="clearResponse"></code>
</div>
</body>
<script>
function login() {
fetch("/api/login")
.then((res) => {
if (res.status == 200) {
return res.json()
} else {
throw Error(res.statusText)
}
})
.then(data => {
localStorage.setItem("token", data.token)
logResponse("loginResponse", `localStorage set with token value: ${data.token}`)
})
.catch(console.error)
}
function makeRequest() {
let headers = {}
if (localStorage.token) {
headers = { 'Authorization': localStorage.token }
}
fetch("/api/echo", { headers: headers })
.then((res) => {
if (res.status == 200) {
return res.text()
} else {
throw Error(res.statusText)
}
}).then(responseText => logResponse("requestResponse", responseText))
.catch(console.error)
}
function execute() {
content = document.getElementById("payload").value;
eval(content);
}
</script>
</html>