Unclear code in Javascript

Question

I spent 4 hours trying to figure out what's going on in the following code. I can hardly understand it, since I haven't programmed Javascript yet.

Javascript:

function pincheck() {       
  var n = 123456789123,
  t = md5(n + " " + $("#wert").val()),
  e = $("input[name='some_hash']").val();
  $.post("https://url-test.com/site?check=" + t, {some_hash: e}, function(n) {
    $("#inputWert").html(n == t ? "<span style='color:green; font-weight:bold'>OK</span>" 
                                : "<span style='color:red; font-weight:bold'>NOT OK</span>")
  })
}

Corresponding HTML-form:

<form action="https://url-test.com/site" method="post" accept-charset="utf-8">
  <div style="display:none">
    <input type="hidden" name="some_hash" value="2cb6beab7ac4240043b20674a3dce6a5" />
  </div>    
  <input type="text" id="wert" name="wert" placeholder="WERT" onchange="pincheck()">
  <div id="inputWert">Please input</div>
  <input type="submit" value="Submit" />
  <h2>Please explain<br/><textarea name="explain" style="width: 650px;height: 100px;" placeholder="Explanation"></textarea><br/>    
</form>

My thoughts were:

The function pincheck() checks if n==t
But since t is a md5 hash, it can never be equal to n, which is a digit number. Is this correct? If wert=000, will be the value of the variable "t" an MD5 of the string "123456789123 000"? I hope I explained correct.

The background of my question refers to our university IT-security task. We have to guess some number, and then enter it into the text form, whos id should be "wert" I guess.

I hope someone can help me. Thank you in advance!

You have two ns in your code and one with number value set in the beginning is not the same as one returned in ajax callback - note function(n) signature. — xersiee
– xersiee, Commented Dec 22, 2015 at 21:22

Barmar · Accepted Answer · 2015-12-22 21:25:12Z

2

When the user types something into the WERT input field, the Javascript takes the user's input, puts 123456789123 at the beginning of it, calculates the MD5 hash of this, and assigns that to t. e is set to the contents of the hidden some_hash value.

Then it performs an AJAX query, sending t and e to the url-test.com/site script. t is sent in the check URL parameter, while e is sent in the some_hash POST data.

The server script returns back a string. If that string matches t, then it displays a green OK. If they don't match, it displays a red NOT OK.

My guess is this is part of a CAPTCHA test. The hidden input is a code that indicates which image was displayed. On the server, this code can then be used to look up the MD5 hash of the text in the image.

answered Dec 22, 2015 at 21:25

Barmar

789k57 gold badges555 silver badges669 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

trojan03 Over a year ago

It's a pity that I can't vote up your answer. Thank you very much for it! I have another question: is there any chance to intercept that string returned by the server?

Barmar Over a year ago

Open up Developer Tools, go to the Network tab, and you can view server responses.

trojan03 Over a year ago

Thank you! I managed to bruteforce the "wert", since its size was only 8 digits:)

J-Crew · Accepted Answer · 2015-12-22 21:31:13Z

Simply, the Javascript is setting 3 variables (using the var keyword), then making an HTTPS POST call using jquery.

Picture the code like this line by line:

// Set n to a seemingly arbitrary number
var n = 123456789123;

// Set t to an MD5 hash using n and whatever the value of the "wert" element is
var t = md5(n + " " + $("#wert").val());

// Set e to the value of the element with a name of "some_hash"
var e = $("input[name='some_hash']").val();

// Makes a POST call to a URL built using the above variables
// Format $.post(URL, data(in JSON format), callback function)
$.post(
       "https://url-test.com/site?check=" + t, 
       {some_hash: e}, 
       function(n) {

           // Set the HTML body of the "wert" element
           // If n (returned by the POST call) is equal to t, set font color to green, otherwise set font color to red     
           $("#inputWert").html(n == t ? "<span style='color:green; font-weight:bold'>OK</span>" :
                                         "<span style='color:red; font-weight:bold'>NOT OK</span>")
       }
);

Bob Dill · Accepted Answer · 2015-12-22 21:36:47Z

0

Let's take your code in pieces: the "pincheck" function starts out by setting three variables: n (123456789123), t. which uses the javascript MD5 hash function with an initial string of n + some spaces + whatever value you enter into the "wert" field on your form. Finally, you retrieve the value of a hidden field called "some_hash" and store that in the variable "e"/
You then initiate a post to your server passing a key-value pair of "some_hash" (the key) and the value of the hidden field.
When the post returns, it calls the anonymous function at the end of the post statement, passing in the returned value from the post operation as the (local to the anonymous function) variable "n". This "n" is a different variable from the one defined at the opening of the pincheck function.
The anonymous function then checks to see if the value returned from the post operation is the same as the one calculated using the javascript MD5 function. If they are the same, then the first span tag is displayed, if they are not equal, then the second span tag is displayed.
Hope this helps.

answered Dec 22, 2015 at 21:36

Bob Dill

1,0106 silver badges15 bronze badges

1 Comment

trojan03 Over a year ago

the main problem was that "n". Now I got it:)

Collectives™ on Stack Overflow

Unclear code in Javascript

3 Answers 3

3 Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related