Add
This commit is contained in:
parent
0b263517b7
commit
5d22571d4b
105
resources/views/hacker/cors.blade.php
Normal file
105
resources/views/hacker/cors.blade.php
Normal file
|
|
@ -0,0 +1,105 @@
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="en">
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8">
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||||
|
<title>CORS Exploitation Lab</title>
|
||||||
|
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
|
||||||
|
</head>
|
||||||
|
<body class="bg-gray-900 text-gray-100 font-sans min-h-screen p-8">
|
||||||
|
<div class="max-w-4xl mx-auto">
|
||||||
|
<h1 class="text-3xl font-bold text-red-500 mb-6 border-b border-red-500/30 pb-4">
|
||||||
|
Cross-Origin Resource Sharing (CORS) Lab
|
||||||
|
</h1>
|
||||||
|
|
||||||
|
<p class="text-gray-400 mb-8">
|
||||||
|
Attempting to read data from <code class="bg-gray-800 px-2 py-1 rounded text-green-400">https://webapp.kr-rezvan.ir/api/secret-data</code>
|
||||||
|
which does NOT have CORS headers allowing this domain.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<div class="grid grid-cols-1 md:grid-cols-2 gap-6 mb-8">
|
||||||
|
<!-- Test 1: Standard Fetch -->
|
||||||
|
<div class="bg-gray-800 p-6 rounded-lg border border-gray-700 hover:border-gray-500 transition">
|
||||||
|
<h2 class="text-xl font-bold text-blue-400 mb-2">Test 1: Standard Fetch</h2>
|
||||||
|
<p class="text-sm text-gray-400 mb-4">Standard cross-origin request. Browser will enforce Same-Origin Policy.</p>
|
||||||
|
<button id="btn-standard" class="w-full bg-blue-600 hover:bg-blue-700 text-white font-bold py-2 px-4 rounded mb-4">
|
||||||
|
Run Standard Fetch
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Test 2: No-CORS Fetch -->
|
||||||
|
<div class="bg-gray-800 p-6 rounded-lg border border-gray-700 hover:border-gray-500 transition">
|
||||||
|
<h2 class="text-xl font-bold text-yellow-400 mb-2">Test 2: No-CORS Mode</h2>
|
||||||
|
<p class="text-sm text-gray-400 mb-4">Forces request using <code class="text-xs bg-gray-900 p-1">mode: 'no-cors'</code>. Network request happens, but JS cannot see data.</p>
|
||||||
|
<button id="btn-nocors" class="w-full bg-yellow-600 hover:bg-yellow-700 text-white font-bold py-2 px-4 rounded mb-4">
|
||||||
|
Run No-CORS Fetch
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Output Console -->
|
||||||
|
<div class="bg-black rounded-lg border border-gray-700 shadow-2xl overflow-hidden">
|
||||||
|
<div class="bg-gray-800 px-4 py-2 border-b border-gray-700 flex justify-between items-center">
|
||||||
|
<span class="text-sm font-mono text-gray-400">Browser Console Output</span>
|
||||||
|
<button onclick="document.getElementById('console-output').innerHTML=''" class="text-xs text-gray-500 hover:text-white">Clear</button>
|
||||||
|
</div>
|
||||||
|
<pre id="console-output" class="p-4 font-mono text-sm h-64 overflow-y-auto text-green-400 whitespace-pre-wrap"></pre>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<script>
|
||||||
|
const log = (msg, type = 'info') => {
|
||||||
|
const out = document.getElementById('console-output');
|
||||||
|
let color = 'text-green-400';
|
||||||
|
if (type === 'error') color = 'text-red-500';
|
||||||
|
if (type === 'warn') color = 'text-yellow-500';
|
||||||
|
|
||||||
|
const time = new Date().toLocaleTimeString();
|
||||||
|
out.innerHTML += `<span class="text-gray-600">[${time}]</span> <span class="${color}">${msg}</span>\n`;
|
||||||
|
out.scrollTop = out.scrollHeight;
|
||||||
|
};
|
||||||
|
|
||||||
|
const targetUrl = 'https://webapp.kr-rezvan.ir/api/secret-data';
|
||||||
|
|
||||||
|
document.getElementById('btn-standard').addEventListener('click', async () => {
|
||||||
|
log('Starting Standard Fetch...', 'info');
|
||||||
|
try {
|
||||||
|
const response = await fetch(targetUrl);
|
||||||
|
const data = await response.json();
|
||||||
|
log(`SUCCESS: Data stolen: ${JSON.stringify(data)}`, 'warn');
|
||||||
|
} catch (error) {
|
||||||
|
log(`CORS ERROR: Browser blocked the read!`, 'error');
|
||||||
|
log(`Details: ${error.message}`, 'error');
|
||||||
|
log('Note: Open DevTools (F12) Console to see the actual CORS policy error from the browser.', 'info');
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
document.getElementById('btn-nocors').addEventListener('click', async () => {
|
||||||
|
log(`Starting Fetch with { mode: 'no-cors' }...`, 'info');
|
||||||
|
try {
|
||||||
|
const response = await fetch(targetUrl, { mode: 'no-cors' });
|
||||||
|
log(`Network request succeeded, but response is OPAQUE.`, 'warn');
|
||||||
|
log(`Response Type: ${response.type}`, 'warn');
|
||||||
|
log(`Response Status: ${response.status}`, 'warn');
|
||||||
|
log(`Response StatusText: "${response.statusText}"`, 'warn');
|
||||||
|
|
||||||
|
// Attempt to read body
|
||||||
|
try {
|
||||||
|
const text = await response.text();
|
||||||
|
if(text === "") {
|
||||||
|
log('Response body is completely EMPTY to JavaScript.', 'warn');
|
||||||
|
} else {
|
||||||
|
log(`Body: ${text}`, 'warn');
|
||||||
|
}
|
||||||
|
} catch(e) {
|
||||||
|
log(`Could not read body: ${e.message}`, 'error');
|
||||||
|
}
|
||||||
|
|
||||||
|
log('Conclusion: Network request hit the server, but browser hid the response from JS.', 'info');
|
||||||
|
} catch (error) {
|
||||||
|
log(`Unexpected Error: ${error.message}`, 'error');
|
||||||
|
}
|
||||||
|
});
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
@ -11,8 +11,8 @@
|
||||||
<h1 class="text-2xl font-bold mb-6">Our External Partners</h1>
|
<h1 class="text-2xl font-bold mb-6">Our External Partners</h1>
|
||||||
<p class="mb-4 text-gray-600">Click the links below to visit our partners. Notice the tab behavior.</p>
|
<p class="mb-4 text-gray-600">Click the links below to visit our partners. Notice the tab behavior.</p>
|
||||||
<ul class="space-y-4">
|
<ul class="space-y-4">
|
||||||
<li><a href="http://hackerapp.eitebar.ir/tabnab" target="_blank" class="text-blue-600 font-bold hover:underline">1. Partner Link (Default Browser Behavior)</a></li>
|
<li><a href="https://hackerapp.eitebar.ir/tabnab" target="_blank" class="text-blue-600 font-bold hover:underline">1. Partner Link (Default Browser Behavior)</a></li>
|
||||||
<li><a href="http://hackerapp.eitebar.ir/tabnab" target="_blank" rel="opener" class="text-red-600 font-bold hover:underline">2. Partner Link (Vulnerable - Explicit Opener)</a></li>
|
<li><a href="https://hackerapp.eitebar.ir/tabnab" target="_blank" rel="opener" class="text-red-600 font-bold hover:underline">2. Partner Link (Vulnerable - Explicit Opener)</a></li>
|
||||||
</ul>
|
</ul>
|
||||||
</div>
|
</div>
|
||||||
</body>
|
</body>
|
||||||
|
|
|
||||||
|
|
@ -58,6 +58,11 @@
|
||||||
Route::get('/fake-login', function () {
|
Route::get('/fake-login', function () {
|
||||||
return view('hacker.fake-login');
|
return view('hacker.fake-login');
|
||||||
})->name('hacker.fake-login');
|
})->name('hacker.fake-login');
|
||||||
|
|
||||||
|
// CORS Test Exploit Page
|
||||||
|
Route::get('/cors-test', function () {
|
||||||
|
return view('hacker.cors');
|
||||||
|
})->name('hacker.cors');
|
||||||
|
|
||||||
});
|
});
|
||||||
|
|
||||||
|
|
@ -95,6 +100,15 @@
|
||||||
Route::get('/partners', function () {
|
Route::get('/partners', function () {
|
||||||
return view('user.partners');
|
return view('user.partners');
|
||||||
})->name('user.partners');
|
})->name('user.partners');
|
||||||
|
|
||||||
|
// Dummy API endpoint simulating sensitive user data (No CORS headers)
|
||||||
|
Route::get('/api/secret-data', function () {
|
||||||
|
return response()->json([
|
||||||
|
'user' => 'admin_rezvan',
|
||||||
|
'balance' => '50,000 USD',
|
||||||
|
'credit_card' => '****-****-****-1234'
|
||||||
|
]);
|
||||||
|
})->name('user.api.secret');
|
||||||
|
|
||||||
// ----- بخشهای محافظت شده با سشن -----
|
// ----- بخشهای محافظت شده با سشن -----
|
||||||
Route::middleware(['web', 'auth'])->group(function () {
|
Route::middleware(['web', 'auth'])->group(function () {
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue
Block a user