Skip to content

Instantly share code, notes, and snippets.

@mrrootsec
Created January 27, 2026 06:46
Show Gist options
  • Select an option

  • Save mrrootsec/244ee91415c6e60b50e64e01d87fef71 to your computer and use it in GitHub Desktop.

Select an option

Save mrrootsec/244ee91415c6e60b50e64e01d87fef71 to your computer and use it in GitHub Desktop.
javascript:(function(){const avoidParams=['aspsessionid','asp.net_sessionid','__eventtarget','__eventargument','__viewstate','__eventvalidation','jsessionid','cfid','cftoken','phpsessid','session_id'];const shouldAvoid=(n)=>{const l=n.toLowerCase();return avoidParams.includes(l)||/^aspsessionid.*/.test(l)};const hiddenInputs=document.querySelectorAll('input[type="hidden"]');let params=new URLSearchParams();let extractedParams={};hiddenInputs.forEach(input=>{const name=input.name;const value=input.value||'xxxx';if(!name||shouldAvoid(name))return;params.append(name,value);extractedParams[name]=value});const url=new URL(window.location);params.forEach((value,key)=>{url.searchParams.append(key,value)});const logData={timestamp:'2025-10-24 02:47:10',user:'mosaqlain_deloitte',currentUrl:window.location.href,newUrl:url.toString(),extractedHiddenInputs:extractedParams,totalExtracted:Object.keys(extractedParams).length};console.log('=== HIDDEN INPUT EXTRACTOR LOG ===');console.log('Timestamp (UTC):', logData.timestamp);console.log('User:', logData.user);console.log('Current URL:', logData.currentUrl);console.log('New URL:', logData.newUrl);console.log('Extracted Hidden Inputs:', logData.extractedHiddenInputs);console.log('Total Parameters Extracted:', logData.totalExtracted);console.log('====================================');alert(`Extracted ${logData.totalExtracted} hidden inputs.\nCheck console for details.\n\nRedirecting to new URL...`);window.location.href=url.toString()})();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment