diff --git a/resources/views/hacker/local-scan.blade.php b/resources/views/hacker/local-scan.blade.php new file mode 100644 index 0000000..4e315f6 --- /dev/null +++ b/resources/views/hacker/local-scan.blade.php @@ -0,0 +1,173 @@ + + + + + + Local Network Scanner Lab + + + + + +
+ +
+

Local Network Port Scanner (Timing Attack)

+

Abusing the browser to scan private network boundaries.

+
+ +
+ + +
+
+ root@c2-server:~# ./scan_local.sh + +
+ +
+
+ [*] Initializing timing attack engine...
+ [*] Warning: Strict timeout set to 1500ms.
+ [*] Click 'Start Scan' to begin. +
+ +
+
+ + +
+

Developer Notes

+ +
+

+ How it works: Browsers restrict reading cross-origin data (CORS), but they typically still allow the network request to be sent (opaque responses). By measuring exactly how long a fetch() takes to fail, we can infer the port status. +

+

+ Active Rejection vs. Timeout: If a local port is open/active, it quickly rejects the cross-origin request (or returns an opaque response). If the IP doesn't exist or a firewall drops the packet silently, the request hangs until our manual 1500ms timeout kills it. +

+
+ The Threat: + Attackers can map your home network (routers, IoT devices, local dev servers) simply by having you visit their public webpage. This is often step 1 before a local CSRF exploit against a vulnerable router. +
+
+ RBI / Zero Trust Protection: + Enterprise Browsers and RBI solutions enforce strict network isolation. They run in a cloud container and are explicitly blocked from routing traffic to private IP ranges (192.168.x.x, 10.x.x.x, localhost). The scan completely fails. +
+
+
+ +
+ +
+ + + + + + + 🏠 Back to Lab Directory + + + + \ No newline at end of file diff --git a/resources/views/user/lab-directory.blade.php b/resources/views/user/lab-directory.blade.php index a2abc1e..14d26fc 100644 --- a/resources/views/user/lab-directory.blade.php +++ b/resources/views/user/lab-directory.blade.php @@ -117,6 +117,15 @@ Launch Lab + + +
+
+

Local Network Scan

+

Abuse the browser to scan private network boundaries via timing attacks.

+ Launch Lab +
+
diff --git a/routes/web.php b/routes/web.php index 0c98b98..64d417e 100644 --- a/routes/web.php +++ b/routes/web.php @@ -73,6 +73,11 @@ Route::get('/fingerprint', function () { return view('hacker.fingerprint'); })->name('hacker.fingerprint'); + + // Local Network Scan Exploit Page + Route::get('/local-scan', function () { + return view('hacker.local-scan'); + })->name('hacker.local-scan'); }); @@ -123,7 +128,7 @@ // Central Lab Directory Route Route::get('/labs', function () { return view('user.lab-directory'); - })->name('user.labs'); + })->withoutMiddleware([VulnerableHeadersMiddleware::class])->name('user.labs'); // ----- بخش‌های محافظت شده با سشن ----- Route::middleware(['web', 'auth'])->group(function () { @@ -145,4 +150,4 @@ // (فضای خالی برای حملات بعدی مثل Phishing، MITB و ...) }); -}); \ No newline at end of file +});