mcoder_rezvan2/browser-sec-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add

Browse Source
This commit is contained in:
mcoder 2026-04-18 15:59:20 +03:30
parent 915d2c2249
commit 719fa7c1df
2 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
resources/views/hacker/xsleak.blade.php
View File

@ -88,7 +88,7 @@
const startBtn = document.getElementById('start-btn'); const startBtn = document.getElementById('start-btn');
// Words we want to check against the victim's private database // Words we want to check against the victim's private database
const targetWords = ['guest', 'confidential', 'public', 'project_x', 'random_word', 'admin_rezvan']; const targetWords = ['guest', 'confidential', 'public', 'project_x', 'random_word', 'admin_panel'];
const THRESHOLD_MS = 400; // If response takes > 400ms, assume the DB did work (HIT) const THRESHOLD_MS = 400; // If response takes > 400ms, assume the DB did work (HIT)
function log(msg, type = 'info') { function log(msg, type = 'info') {

23
routes/web.php
View File

@ -142,20 +142,23 @@
// ----- بخش‌های محافظت شده با سشن ----- // ----- بخش‌های محافظت شده با سشن -----
Route::middleware(['web', 'auth'])->group(function () { Route::middleware(['web', 'auth'])->group(function () {
// XS-Leak Target API
Route::get('/api/private-search', function (Illuminate\Http\Request $request) { Route::get('/api/private-search', function (Illuminate\Http\Request $request) {
$query = strtolower($request->query('q', '')); $query = strtolower($request->query('q', ''));
$privateKeywords = ['confidential', 'admin_rezvan', 'project_x']; $privateKeywords = ['confidential', 'admin_panel', 'project_x'];
if (in_array($query, $privateKeywords)) { if (in_array($query, $privateKeywords)) {
// Keyword exists: Simulate DB fetching taking 600ms $hash = 'start';
usleep(600000); for ($i = 0; $i < 100000; $i++)
} else { {
// Keyword missing: Fast return 50ms $hash = md5($hash . $query);
usleep(50000); }
} }
else
{
$hash = md5($query);
}
return response()->json(['status' => 'search_complete']); return response()->json(['status' => 'search_complete']);
})->name('user.api.search'); })->name('user.api.search');