Lauritz lauritzh

## test.php
<!--
Launch: $ php -S 127.0.0.1:1234
Access via http://localhost:1234/test.php?p=test
-->
<?= header('Content-Type: text/xml'); ?>
aaa
bbb
<?= print_r($_GET['p']); ?>
ccc
ddd

## poc.js
//
// Headless SSO Login CSRF PoC
// (c) Lauritz Holtmann, 2023
//

const pt = require('puppeteer')
const express = require('express')
const app = express()
const port = 3000

## download_apks.sh
#!/bin/bash
# Usage: ./download_apks.sh com.example.app

BUNDLE_FILES=$(adb shell pm path "$1")

for file in $BUNDLE_FILES; do
	CLEAN=$(echo "$file"|sed 's/[^:]*://')
	adb pull "$CLEAN" .
done

## vue-csti.php
<!--
//
// Vue 3 XSS example
// 1. Launch as follows:
//    $ php -S 127.0.0.1:1234
// 2. Access at http://localhost:1234/vue-csti.php?name=you and try to pop an alert!
//
// (c) Lauritz Holtmann
//
-->

## oidc_discovery.php
<?php
/*
* (c) Lauritz Holtmann, https://security.lauritz-holtmann.de
*
* Could be for instance launched as follows:
* $ php -S 127.0.0.1:1234
* $ ngrok http 1234
*
* Visit https://something.ngrok.io/oidc_dicovery.php
*/
	<!--
	Launch: $ php -S 127.0.0.1:1234
	Access via http://localhost:1234/test.php?p=test
	-->
	<?= header('Content-Type: text/xml'); ?>
	aaa
	bbb
	<?= print_r($_GET['p']); ?>
	ccc
	ddd
	//
	// Headless SSO Login CSRF PoC
	// (c) Lauritz Holtmann, 2023
	//

	const pt = require('puppeteer')
	const express = require('express')
	const app = express()
	const port = 3000
	#!/bin/bash
	# Usage: ./download_apks.sh com.example.app

	BUNDLE_FILES=$(adb shell pm path "$1")

	for file in $BUNDLE_FILES; do
	CLEAN=$(echo "$file"\|sed 's/[^:]*://')
	adb pull "$CLEAN" .
	done
	<!--
	//
	// Vue 3 XSS example
	// 1. Launch as follows:
	// $ php -S 127.0.0.1:1234
	// 2. Access at http://localhost:1234/vue-csti.php?name=you and try to pop an alert!
	//
	// (c) Lauritz Holtmann
	//
	-->
	<?php
	/*
	* (c) Lauritz Holtmann, https://security.lauritz-holtmann.de
	*
	* Could be for instance launched as follows:
	* $ php -S 127.0.0.1:1234
	* $ ngrok http 1234
	*
	* Visit https://something.ngrok.io/oidc_dicovery.php
	*/