> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/root-me/web-client/javascript-authentication-2.md).

# Javascript - Authentication 2

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FIhRrQTAsMg8nxLwWZVl8%2F1.png?alt=media&amp;token=bdfd9da8-4f54-4360-9cde-0226e7c46453" alt=""><figcaption></figcaption></figure>

When we click on the login button, a dialog box pops up prompting us to enter the username and password.

Let's check the source code.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FWiEtmLMal95xhoRYNWdF%2F2.png?alt=media&amp;token=80f7e514-608a-42f3-a890-d508d0a48d75" alt=""><figcaption></figcaption></figure>

* We can see that the `login.js` file is where the script is being imported from. We can follow the link to check it out.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F4PhtBYXrGpKxqOZbIzLm%2F3.png?alt=media&amp;token=df97a024-f9ef-45f2-9cb0-ad278a0ba5f3" alt=""><figcaption></figcaption></figure>

So this is where the input authentication takes place.

```javascript
function connexion(){
    var username = prompt("Username :", "");
    var password = prompt("Password :", "");
    var TheLists = ["GOD:HIDDEN"];
    for (i = 0; i < TheLists.length; i++)
    {
        if (TheLists[i].indexOf(username) == 0)
        {
            var TheSplit = TheLists[i].split(":");
            var TheUsername = TheSplit[0];
            var ThePassword = TheSplit[1];
            if (username == TheUsername && password == ThePassword)
            {
                alert("Vous pouvez utiliser ce mot de passe pour valider ce challenge (en majuscules) / You can use this password to validate this challenge (uppercase)");
            }
        }
        else
        {
            alert("Nope, you're a naughty hacker.")
        }
    }
}
```

There is an array `TheLists` containing one element: `GOD:HIDDEN`.

It checks if the username entered by the user matches the username from the current element in the `TheLists` array (using `TheLists[i].indexOf(username) == 0`).

If there is a match, it splits the current element into username and password using `split(":")`, and then it compares the entered username and password with the stored values. If both match, it displays an alert with a success message.

Let's enter the credentials.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FXqUateKNWbKCEUwa1POu%2F4.png?alt=media&amp;token=dfdc7341-7f35-4912-98f5-eaa1eb15b3db" alt=""><figcaption></figcaption></figure>

## Password

```
HIDDEN
```
