forked from nccgroup/singularity
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathmanager.html
More file actions
217 lines (194 loc) · 10.3 KB
/
Copy pathmanager.html
File metadata and controls
217 lines (194 loc) · 10.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
<!doctype html>
<html lang="en">
<head>
<title>Singularity of Origin DNS Rebinding Attack Manager</title>
<script src="manager.js"></script>
<meta charset="utf-8">
<meta http-equiv="x-dns-prefetch-control" content="off">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/css/bootstrap.min.css"
integrity="sha384-9gVQ4dYFwwWSjIDZnLEWnxCjeSWFphJiwGPXr1jddIhOegiu1FwO5qRGvFXOdJZ4" crossorigin="anonymous">
</head>
<body>
<div class="container-fluid">
<h3>Singularity of Origin DNS Rebinding Attack</h3>
<small class="text-muted">
This attack typically takes ~1 min to work. This duration can be reduced to ~3s with the appropriate
options. Check the <a href="https://github.com/nccgroup/singularity">documentation</a>. Try the new,
experimental HTTP port <a href="scan-manager.html">scanner</a>. Test the automatic identification of
vulnerable services on your network upon visiting this <a href="autoattack.html">page</a>.
</small>
<form action="javascript:void(0);">
<div class="form-group row">
<div class="col-3">
<label for="attackhostdomain">Attack Host Domain</label>
</div>
<div class="col-5">
<input id=attackhostdomain class="form-control" placeholder="e.g. dynamic.attacker.com" value=""
spellcheck="false" />
</div>
</div>
<div class="form-group row">
<div class="col-2">
<label for="attackhostipaddress">Attack Host</label>
</div>
<div class="col-4">
<input id=attackhostipaddress class="form-control" placeholder="xxx.xxx.xxx.xxx" value=""
spellcheck="false" />
</div>
<div class="col-2">
<label for="targethostipaddress">Target Host</label>
</div>
<div class="col-4">
<input id=targethostipaddress class="form-control" value="127.0.0.1" spellcheck="false"
data-toggle="tooltip" data-placement="top"
title="IP address, hostname, or FQDN (e.g. 127.0.0.1, 0.0.0.0, localhost, wiki, www.example.com)" />
</div>
</div>
<div class="form-group">
<div class="row">
<div class="col-2">
<label for="targetport">Target Port</label>
</div>
<div class="col-2">
<input id=targetport class="form-control" aria-describedby="targetportHelp"
placeholder="e.g. 80" value="" />
</div>
<div class="col-2">
<input onclick="requestPort()" id=requestport type=submit value="Request New Port" disabled>
</div>
</div>
<div class="row">
<div class="col-12">
<small id="targetportHelp" class="form-text text-muted">Attack server listening on:
<span id=listenports>unknown</span>. The attack and target hosts must be listening on the
same port. The "Request New Port" button is only available when the server is started with
the "-dangerouslyAllowDynamicHTTPServers" command line argument. </small>
</div>
</div>
</div>
<div class="form-group row">
<div class="col-2">
<label for="payloads">Attack Payload</label>
</div>
<div class="col-5">
<select id="payloads" class="payloads-dropdown-content"></select>
</div>
</div>
<div class="form-group row">
<div class="col-3">
<input onclick="app.begin()" id=start type=submit value="Start Attack" autofocus>
</div>
<div class="col-3">
<input onclick="toggle()" type=submit value="Toggle Advanced Options">
</div>
</div>
<div id=advanced class="d-none">
<div class="form-group row d-none">
<div class="col-2">
<label for="dummyport">Dummy Port</label>
</div>
<div class="col-2">
<input id=dummyport class="form-control" aria-describedby="dummyportHelp" value="4000" />
</div>
<div class="col-8">
<small id="dummyportHelp" class="form-text text-muted">Specify a port on which the attack host
does not listen to permit browser fast DNS cache eviction.
If not possible, use a reachable port serviced by a web server.</small>
</div>
</div>
<div class="form-group row">
<div class="col-2">
<label for="rebindingStrategy">Rebinding Strategy</label>
</div>
<div class="col-3">
<select id="rebindingStrategy" class="rebindingstrategy-dropdown-content">
<option id="fs" value="fs" title="Default, conservative">First then second</option>
<option id="ma" value="ma" title="Fast">Multiple answers</option>
<option id="rr" value="rr" title="IPS/filters evasion">Round robin</option>
<option id="rd" value="rd" title="IPS/filters evasion">Random</option>
</select>
</div>
<div class="col-7">
<small id="rebindingstrategyHelp" class="form-text text-muted">
Read the docs if changing from the default value to ensure that the attack will succeed.
</small>
</div>
</div>
<div class="form-group row">
<div class="col-2">
<label for="attackmethod">Attack Method</label>
</div>
<div class="col-3">
<select id="attackmethod" class="attackmethod-dropdown-content">
<option id="fetch" value="fetch" title="Default">Fetch API</option>
<option id="iframe" value="iframe" title="PNA Evasion">Inline Frame</option>
</select>
</div>
<div class="col-7">
<small id="attackMethodHelp" class="form-text text-muted">
Fetch API works with most browsers, but is blocked by Chrome by most (but not all) target configurations. Inline Frame should work with most browsers, unless the target application does not allow rendering in an iframe.
</small>
</div>
</div>
<div class="form-group row">
<div class="col-2">
<label for="interval">Interval</label>
</div>
<div class="col-2">
<input id=interval class="form-control" aria-describedby="intervalHelp" value="20"
title="Recommendation: 1 second when using 'Multiple answers', 20 seconds for all other rebinding strategies" />
</div>
<div class="col-8">
<small id="intervalHelp" class="form-text text-muted">How long to wait between attempts in
seconds.</small>
</div>
</div>
<div class="form-group row">
<div class="col-2">
<label for="flushdns">Flood DNS Cache</label>
</div>
<div class="col-1">
<input id=flushdns type="checkbox" value="" aria-describedby="flushdnsHelp" />
</div>
<div class="col-8">
<small id="flushdnsHelp" class="checkbox text-muted">Attempt flushing the browser DNS cache.
Successfully tested on Chrome.</small>
</div>
</div>
<div class="form-group row">
<div class="col-2">
<label for="indextoken">Index Token</label>
</div>
<div class="col-3">
<input id=indextoken class="form-control" aria-describedby="indextokenHelp"
value="thisismytesttoken" spellcheck="false" />
</div>
<div class="col-7">
<small id="indextokenHelp" class="form-text text-muted">The attack uses this string to
recognize whether it is accessing the attacker or target host. it
must be placed in the index page of the attacker web server.</small>
</div>
</div>
<div class="form-group row">
<div class="col-2">
<label for="interval">WS/Proxy Port</label>
</div>
<div class="col-2">
<input id=wsproxyport class="form-control" aria-describedby="wsproxyportHelp" value="3129"
title="Change this value if you invoked Singularity with a different websockets/proxy port value" />
</div>
<div class="col-8">
<small id="wsproxyportHelp" class="form-text text-muted">TCP port on which Singularity listens to handle websockets and proxy operations.</small>
</div>
</div>
</div>
</form>
<div id=message class="d-none">
Please wait for DNS cache entries to expire.
</div>
<div id=attackframes>
</div>
</div>
</body>
</html>