mcoder_rezvan2/browser-sec-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add

Browse Source
This commit is contained in:
mcoder 2026-04-17 19:34:23 +03:30
parent 0b263517b7
commit 5d22571d4b
3 changed files with 121 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

105
resources/views/hacker/cors.blade.php Normal file
View File

@ -0,0 +1,105 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CORS Exploitation Lab</title>
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
</head>
<body class="bg-gray-900 text-gray-100 font-sans min-h-screen p-8">
<div class="max-w-4xl mx-auto">
<h1 class="text-3xl font-bold text-red-500 mb-6 border-b border-red-500/30 pb-4">
Cross-Origin Resource Sharing (CORS) Lab
</h1>
<p class="text-gray-400 mb-8">
Attempting to read data from <code class="bg-gray-800 px-2 py-1 rounded text-green-400">https://webapp.kr-rezvan.ir/api/secret-data</code>
which does NOT have CORS headers allowing this domain.
</p>
<div class="grid grid-cols-1 md:grid-cols-2 gap-6 mb-8">
<!-- Test 1: Standard Fetch -->
<div class="bg-gray-800 p-6 rounded-lg border border-gray-700 hover:border-gray-500 transition">
<h2 class="text-xl font-bold text-blue-400 mb-2">Test 1: Standard Fetch</h2>
<p class="text-sm text-gray-400 mb-4">Standard cross-origin request. Browser will enforce Same-Origin Policy.</p>
<button id="btn-standard" class="w-full bg-blue-600 hover:bg-blue-700 text-white font-bold py-2 px-4 rounded mb-4">
Run Standard Fetch
</button>
</div>
<!-- Test 2: No-CORS Fetch -->
<div class="bg-gray-800 p-6 rounded-lg border border-gray-700 hover:border-gray-500 transition">
<h2 class="text-xl font-bold text-yellow-400 mb-2">Test 2: No-CORS Mode</h2>
<p class="text-sm text-gray-400 mb-4">Forces request using <code class="text-xs bg-gray-900 p-1">mode: 'no-cors'</code>. Network request happens, but JS cannot see data.</p>
<button id="btn-nocors" class="w-full bg-yellow-600 hover:bg-yellow-700 text-white font-bold py-2 px-4 rounded mb-4">
Run No-CORS Fetch
</button>
</div>
</div>
<!-- Output Console -->
<div class="bg-black rounded-lg border border-gray-700 shadow-2xl overflow-hidden">
<div class="bg-gray-800 px-4 py-2 border-b border-gray-700 flex justify-between items-center">
<span class="text-sm font-mono text-gray-400">Browser Console Output</span>
<button onclick="document.getElementById('console-output').innerHTML=''" class="text-xs text-gray-500 hover:text-white">Clear</button>
</div>
<pre id="console-output" class="p-4 font-mono text-sm h-64 overflow-y-auto text-green-400 whitespace-pre-wrap"></pre>
</div>
</div>
<script>
const log = (msg, type = 'info') => {
const out = document.getElementById('console-output');
let color = 'text-green-400';
if (type === 'error') color = 'text-red-500';
if (type === 'warn') color = 'text-yellow-500';
const time = new Date().toLocaleTimeString();
out.innerHTML += `<span class="text-gray-600">[${time}]</span> <span class="${color}">${msg}</span>\n`;
out.scrollTop = out.scrollHeight;
};
const targetUrl = 'https://webapp.kr-rezvan.ir/api/secret-data';
document.getElementById('btn-standard').addEventListener('click', async () => {
log('Starting Standard Fetch...', 'info');
try {
const response = await fetch(targetUrl);
const data = await response.json();
log(`SUCCESS: Data stolen: ${JSON.stringify(data)}`, 'warn');
} catch (error) {
log(`CORS ERROR: Browser blocked the read!`, 'error');
log(`Details: ${error.message}`, 'error');
log('Note: Open DevTools (F12) Console to see the actual CORS policy error from the browser.', 'info');
}
});
document.getElementById('btn-nocors').addEventListener('click', async () => {
log(`Starting Fetch with { mode: 'no-cors' }...`, 'info');
try {
const response = await fetch(targetUrl, { mode: 'no-cors' });
log(`Network request succeeded, but response is OPAQUE.`, 'warn');
log(`Response Type: ${response.type}`, 'warn');
log(`Response Status: ${response.status}`, 'warn');
log(`Response StatusText: "${response.statusText}"`, 'warn');
// Attempt to read body
try {
const text = await response.text();
if(text === "") {
log('Response body is completely EMPTY to JavaScript.', 'warn');
} else {
log(`Body: ${text}`, 'warn');
}
} catch(e) {
log(`Could not read body: ${e.message}`, 'error');
}
log('Conclusion: Network request hit the server, but browser hid the response from JS.', 'info');
} catch (error) {
log(`Unexpected Error: ${error.message}`, 'error');
}
});
</script>
</body>
</html>

4
resources/views/user/partners.blade.php
View File

@ -11,8 +11,8 @@
<h1 class="text-2xl font-bold mb-6">Our External Partners</h1>
<p class="mb-4 text-gray-600">Click the links below to visit our partners. Notice the tab behavior.</p>
<ul class="space-y-4">
<li><a href="http://hackerapp.eitebar.ir/tabnab" target="_blank" class="text-blue-600 font-bold hover:underline">1. Partner Link (Default Browser Behavior)</a></li>
<li><a href="http://hackerapp.eitebar.ir/tabnab" target="_blank" rel="opener" class="text-red-600 font-bold hover:underline">2. Partner Link (Vulnerable - Explicit Opener)</a></li>
<li><a href="https://hackerapp.eitebar.ir/tabnab" target="_blank" class="text-blue-600 font-bold hover:underline">1. Partner Link (Default Browser Behavior)</a></li>
<li><a href="https://hackerapp.eitebar.ir/tabnab" target="_blank" rel="opener" class="text-red-600 font-bold hover:underline">2. Partner Link (Vulnerable - Explicit Opener)</a></li>
</ul>
</div>
</body>

14
routes/web.php
View File

@ -59,6 +59,11 @@
return view('hacker.fake-login');
})->name('hacker.fake-login');
// CORS Test Exploit Page
Route::get('/cors-test', function () {
return view('hacker.cors');
})->name('hacker.cors');
});
/*
@ -96,6 +101,15 @@
return view('user.partners');
})->name('user.partners');
// Dummy API endpoint simulating sensitive user data (No CORS headers)
Route::get('/api/secret-data', function () {
return response()->json([
'user' => 'admin_rezvan',
'balance' => '50,000 USD',
'credit_card' => '****-****-****-1234'
]);
})->name('user.api.secret');
// ----- بخش‌های محافظت شده با سشن -----
Route::middleware(['web', 'auth'])->group(function () {