m0m0x01d 3.0.0 → 5.0.0
Sign up to get free protection for your applications and to get access to all the features.
- package/package.json +1 -1
- package/redirect.svg.html +25 -0
- package/redirect.svg.php +21 -0
package/package.json
CHANGED
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
<!DOCTYPE html>
|
|
2
|
+
<html lang="en">
|
|
3
|
+
<head>
|
|
4
|
+
<meta charset="UTF-8">
|
|
5
|
+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
6
|
+
<title>Redirect</title>
|
|
7
|
+
<script>
|
|
8
|
+
window.onload = function() {
|
|
9
|
+
// Get the URL query parameter
|
|
10
|
+
const urlParams = new URLSearchParams(window.location.search);
|
|
11
|
+
const targetUrl = urlParams.get('url');
|
|
12
|
+
|
|
13
|
+
// If a valid URL is provided, redirect to it
|
|
14
|
+
if (targetUrl) {
|
|
15
|
+
window.location.href = targetUrl;
|
|
16
|
+
} else {
|
|
17
|
+
document.body.innerHTML = "No URL provided for redirection.";
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
</script>
|
|
21
|
+
</head>
|
|
22
|
+
<body>
|
|
23
|
+
</body>
|
|
24
|
+
</html>
|
|
25
|
+
|
package/redirect.svg.php
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
<?php
|
|
2
|
+
// Get the target URL from the 'next_url' query parameter
|
|
3
|
+
$next_url = isset($_GET['next_url']) ? $_GET['next_url'] : 'https://9lv13zw73wdy5t6hjxcpw5tz9qfh36.burpcollaborator.net';
|
|
4
|
+
|
|
5
|
+
// Set the appropriate headers for the 302 redirect
|
|
6
|
+
header("HTTP/1.1 302 Found");
|
|
7
|
+
header("Location: $next_url");
|
|
8
|
+
|
|
9
|
+
// Optional: Set additional headers if required
|
|
10
|
+
header("Cache-Control: public, max-age=0");
|
|
11
|
+
header("Set-Cookie: sites=; expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; Path=/");
|
|
12
|
+
header("Set-Cookie: sessionid=; expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; Path=/");
|
|
13
|
+
header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
|
|
14
|
+
header("X-Frame-Options: SAMEORIGIN");
|
|
15
|
+
header("X-XSS-Protection: 1; mode=block");
|
|
16
|
+
header("X-Content-Type-Options: nosniff");
|
|
17
|
+
header("Content-Security-Policy: frame-ancestors 'self'; base-uri 'self'; form-action 'self' https://*.example.com; upgrade-insecure-requests");
|
|
18
|
+
|
|
19
|
+
// Ensure the connection is closed after the headers
|
|
20
|
+
exit();
|
|
21
|
+
|