diff --git a/resources/views/hacker/xsleak.blade.php b/resources/views/hacker/xsleak.blade.php new file mode 100644 index 0000000..e9b9593 --- /dev/null +++ b/resources/views/hacker/xsleak.blade.php @@ -0,0 +1,158 @@ + + + + + + XS-Leaks Timing Attack Lab + + + + + +
+ +
+

Cross-Site Leaks (XS-Leaks)

+

Inferring private data via cross-origin execution timing.

+
+ +
+ + +
+
+
+
+
+
+
+ Timing Analysis Module +
+ +
+ +
+
+ > Target API: https://webapp.kr-rezvan.ir/api/private-search?q=[WORD]
+ > Note: CORS blocks us from reading the response body.
+ > Technique: Measuring promise settlement time.
+ > Awaiting execution command... +
+
+
+
+ + +
+

+ + Researcher Notes +

+ +
+

+ The Vulnerability: Even when CORS prevents a malicious site from reading an API's JSON response, the browser still executes the network request. If the server takes a different amount of time to process a "Hit" versus a "Miss", the attacker can measure that difference using performance.now(). +

+

+ State Inference: By systematically querying keywords, an attacker can determine if the logged-in user has access to "project_x" or possesses "confidential" documents, purely based on response latency. +

+
+ 🛡️ Mitigations: +
    +
  • SameSite Cookies: Enforcing SameSite=Lax or Strict prevents the browser from sending the user's session cookie during the cross-origin request, making the timing attack measure the unauthenticated state.
    • +
  • Constant-Time Algorithms: Ensure database queries and code paths execute in the exact same duration regardless of the outcome (often very difficult in complex apps).
    • +
+
+
+
+ +
+
+ + + + + + + 🏠 Back to Lab Directory + + + + \ No newline at end of file diff --git a/resources/views/user/lab-directory.blade.php b/resources/views/user/lab-directory.blade.php index e564848..f03b19a 100644 --- a/resources/views/user/lab-directory.blade.php +++ b/resources/views/user/lab-directory.blade.php @@ -28,7 +28,7 @@ - +

CSRF Attack

@@ -132,7 +132,16 @@

Autofill Trap

Demonstrate how a malicious site steals sensitive user data by hiding input fields populated by Autofill.

- Launch Lab + Launch Lab +
+
+ + +
+
+

XS-Leaks

+

Infer private cross-origin data by measuring network response times.

+ Launch Lab
diff --git a/routes/web.php b/routes/web.php index 03ee44b..2a47e36 100644 --- a/routes/web.php +++ b/routes/web.php @@ -83,6 +83,11 @@ Route::get('/autofill-trap', function () { return view('hacker.autofill'); })->name('hacker.autofill'); + + // XS-Leaks Exploit Page + Route::get('/xs-leak', function () { + return view('hacker.xsleak'); + })->name('hacker.xsleak'); }); @@ -137,6 +142,22 @@ // ----- بخش‌های محافظت شده با سشن ----- Route::middleware(['web', 'auth'])->group(function () { + + // XS-Leak Target API + Route::get('/api/private-search', function (Illuminate\Http\Request $request) { + $query = strtolower($request->query('q', '')); + $privateKeywords = ['confidential', 'admin_rezvan', 'project_x']; + + if (in_array($query, $privateKeywords)) { + // Keyword exists: Simulate DB fetching taking 600ms + usleep(600000); + } else { + // Keyword missing: Fast return 50ms + usleep(50000); + } + + return response()->json(['status' => 'search_complete']); + })->name('user.api.search'); // پروفایل کاربر Route::get('/profile', [UserController::class, 'profile'])->name('user.profile'); @@ -155,4 +176,4 @@ // (فضای خالی برای حملات بعدی مثل Phishing، MITB و ...) }); -}); +}); \ No newline at end of file