Session-Hijacking-Visual-Exploitation/client/visual.html at master · doyensec/Session-Hijacking-Visual-Exploitation · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
<!DOCTYPE html>
<html>
  <head>
    <meta charset="UTF-8" />
    <title>Session: </title>
    <style>
      .iframe-container {
        position: relative;
      }

      .iframe-blocker {
        position: absolute;
        top: 0;
        left: 0;
        width: 100%;
        height: 100%;
        background-color: rgba(0, 0, 0, 0);
        z-index: 1;
      }

      #iframe {
        width: 100%;
        height: 1000px;
        border: none;
      }

      .mouse {
        position: absolute;
        z-index: 2;
        pointer-events: none;
        width: 20px;
        height: auto;
      }
    </style>
  </head>
  <body>
    <div class="iframe-container">
      <iframe id="iframe"></iframe>
      <div class="iframe-blocker"></div>
      <img src="assets/mouse.png" alt="Mouse" class="mouse" style="display:none;" id="mouseImage"/>
    </div>
    <script>
      const protocol = localStorage.getItem('protocol');
      const wsProtocol = (protocol === "https") ? "wss" : "ws";
      const ip = localStorage.getItem('ip');
      const serverPort = localStorage.getItem('serverPort');
      const token = localStorage.getItem('token');
      const ws = new WebSocket(`${wsProtocol}://${ip}:${serverPort}?token=${token}`);


      async function loadDom(data) {
        const html = data.dom;
        const iframe = document.getElementById('iframe');
        iframe.srcdoc = html;

        await new Promise((resolve) => {
          iframe.onload = resolve;
        });

        for (const input of data.inputs) {
          setInput(input.value, input.path);
        }

        setScroll(data.scrollY);
      }

      function setMouse(x, y) {
        const mouseImage = document.getElementById('mouseImage');
        mouseImage.style.left = `${x}px`;
        mouseImage.style.top = `${y}px`;
        mouseImage.style.display = 'block';
      }

      function setScroll(y) {
        const iframe = document.getElementById('iframe');
        const iframeContent = (iframe.contentWindow || iframe.contentDocument);
        iframeContent.scrollTo(0, y);
      }


      function setInput(value, path) {
        const iframe = document.getElementById('iframe');
        const iframeDoc = iframe.contentDocument || iframe.contentWindow.document;
        const element = iframeDoc.evaluate(path, iframeDoc, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null).singleNodeValue;
        if (element) {
          element.value = value;
        }
      }


      ws.onmessage = (event) => {
        const message = JSON.parse(event.data);
        if (message.writeDom) {
          loadDom(message.writeDom.data);
        } else if (message.setMouse) {
          const { x, y } = message.setMouse;
          setMouse(x, y);
        }  else if (message.setScroll) {
          const { y } = message.setScroll;
          setScroll(y);
        } else if (message.setInput) {
          const { value, path } = message.setInput;
          setInput(value, path);
        }
      };
    </script>
  </body>
</html>