74 lines
1.8 KiB
JavaScript
74 lines
1.8 KiB
JavaScript
const puppeteer = require('puppeteer')
|
|
const net = require('net')
|
|
|
|
const BASE_URL = process.env.BASE_URL || 'http://web-oops-app:5000/'
|
|
const FLAG = process.env.FLAG || 'flag{test_flag}'
|
|
|
|
const browserPool = []
|
|
|
|
const getBrowser = async () => {
|
|
if (browserPool.length > 0) {
|
|
return browserPool.pop()
|
|
}
|
|
return await puppeteer.launch({
|
|
headless: true,
|
|
args: ['--js-flags=--jitless', '--no-sandbox', '--disable-setuid-sandbox', '--enable-logging', '--v=1']
|
|
})
|
|
}
|
|
|
|
const returnBrowser = (browser) => {
|
|
browserPool.push(browser)
|
|
}
|
|
|
|
const visitSubmission = async (id) => {
|
|
if (!id.match(/^[0-9a-zA-Z]{6}$/)) {
|
|
return
|
|
}
|
|
const browser = await getBrowser()
|
|
const page = await browser.newPage()
|
|
const hostname = new URL(BASE_URL).hostname
|
|
const fullUrl = BASE_URL + id;
|
|
console.log('[+] Navigating to:', fullUrl);
|
|
await page.setCookie({
|
|
name: 'admin_flag',
|
|
value: FLAG,
|
|
domain: hostname,
|
|
path: '/',
|
|
httpOnly: false,
|
|
secure: false
|
|
})
|
|
try {
|
|
const response = await page.goto(fullUrl, {
|
|
waitUntil: 'networkidle2',
|
|
timeout: 5000
|
|
});
|
|
|
|
console.log('[+] Navigation succeeded:', response.status());
|
|
const finalUrl = page.url();
|
|
console.log('[+] Final URL after redirects:', finalUrl);
|
|
}
|
|
catch (e) {
|
|
console.log(e)
|
|
}
|
|
await page.close()
|
|
returnBrowser(browser)
|
|
}
|
|
|
|
setInterval(() => {
|
|
while (browserPool.length > 0) {
|
|
const browser = browserPool.pop()
|
|
browser.close()
|
|
}
|
|
}, 5 * 60 * 1000)
|
|
|
|
const server = net.createServer((socket) => {
|
|
socket.on('data', async (data) => {
|
|
const id = data.toString()
|
|
await visitSubmission(id)
|
|
})
|
|
})
|
|
|
|
server.listen(3001, () => {
|
|
console.log('Listening on port 3001')
|
|
})
|