23 |
24 |
25 |
26 |
--------------------------------------------------------------------------------
/sonar_fingerprint_generator/manifest.json:
--------------------------------------------------------------------------------
1 | {
2 | "name": "sonar.js - Fingerprint Generator",
3 | "version": "0.1.3",
4 | "manifest_version": 2,
5 | "description": "Fingerprint generator for the sonar.js project",
6 | "homepage_url": "https://github.com/mandatoryprogrammer/sonar.js",
7 | "icons": {
8 | "16": "icons/icon16.png",
9 | "48": "icons/icon48.png",
10 | "128": "icons/icon128.png"
11 | },
12 | "default_locale": "en",
13 | "background": {
14 | "page": "src/bg/background.html",
15 | "persistent": true
16 | },
17 | "browser_action": {
18 | "default_icon": "icons/icon19.png",
19 | "default_title": "browser action demo",
20 | "default_popup": "src/browser_action/browser_action.html"
21 | },
22 | "permissions": [
23 | "http://*/*",
24 | "https://*/*"
25 | ],
26 | "content_scripts": [
27 | {
28 | "matches": [
29 | "http://*/",
30 | "https://*/"
31 | ],
32 | "js": [
33 | "src/inject/inject.js"
34 | ]
35 | }
36 | ]
37 | }
38 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | The MIT License (MIT)
2 |
3 | Copyright (c) 2015 Matthew Bryant
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/sonar_fingerprint_generator/src/browser_action/js/main.js:
--------------------------------------------------------------------------------
1 | chrome.tabs.getSelected( null, function( tab ) {
2 | chrome.tabs.executeScript( tab.id, { file: "/src/inject/inject.js" }, function( return_data ) {
3 | var code = "\t{\r\n \'name\': [FINGERPRINT_NAME_REPLACE_ME],\r\n \'created\': [FINGERPRINT_DATE_REPLACE_ME],\r\n \'resources\': [FINGERPRINT_REPLACE_ME],\r\n \'callback\': function( ip ) {\r\n \/\/ Insert exploit here\r\n },\r\n }";
4 | code = code.replace( '[FINGERPRINT_NAME_REPLACE_ME]', JSON.stringify( 'Example' ) );
5 | code = code.replace( '[FINGERPRINT_REPLACE_ME]', JSON.stringify( remove_duplicates( return_data[0] ) ) );
6 | code = code.replace( '[FINGERPRINT_DATE_REPLACE_ME]', JSON.stringify( new Date().toGMTString() ) );
7 | document.getElementById( 'codeoutput' ).value = code;
8 | });
9 | });
10 |
11 | function copycode() {
12 | document.getElementById("codeoutput").select();
13 | document.execCommand("copy", false, null);
14 | }
15 | document.getElementById("copy2clipboardbutton").addEventListener("click", copycode);
16 |
17 | function remove_duplicates(array){
18 | if ($.isArray(array)){
19 | var dupes = {}; var len, i;
20 | for (i=0,len=array.length;i 0 ) {
27 | prints.push( document_ref.scripts[i].src );
28 | }
29 | }
30 | var new_prints = [];
31 | console.log(prints);
32 | for( var i = 0; i < prints.length; i++ ){
33 | var tmp_print = get_relative_path( prints[i] instanceof Array ? prints[i][0] : prints[i] );
34 | if( tmp_print != false ){
35 | if (prints[i] instanceof Array) {
36 | new_prints.push( [ tmp_print, prints[i][1], prints[i][2] ] );
37 | } else {
38 | new_prints.push( tmp_print );
39 | }
40 | }
41 | }
42 | prints = new_prints;
43 | console.log( prints );
44 | return prints;
45 | }
46 |
47 | function recursive_element_collect( window_ref ) {
48 | var resource_array = [];
49 | for( i = 0; i < window_ref.frames.length; i++ ) {
50 | if( window_ref.frames[i].frames.length > 0 ) {
51 | try {
52 | resource_array = resource_array.concat( recursive_element_collect( window_ref.frames[i] ) );
53 | } catch (e) {}
54 | }
55 | try{
56 | resource_array = resource_array.concat( get_resource_array( window_ref.frames[i].document ) );
57 | } catch (e) {}
58 | try{
59 | resource_array.push( get_relative_path( window_ref.frames[i].location.href ) );
60 | } catch (e) {}
61 | }
62 | resource_array = resource_array.concat( get_resource_array( window_ref.document ) );
63 | return resource_array;
64 | }
65 | resource_array = recursive_element_collect( window );
66 | resource_array
67 |
--------------------------------------------------------------------------------
/sonar_fingerprint_generator/_locales/en/messages.json:
--------------------------------------------------------------------------------
1 | {
2 | "l10nTabName": {
3 | "message":"Localization"
4 | ,"description":"name of the localization tab"
5 | }
6 | ,"l10nHeader": {
7 | "message":"It does localization too! (this whole tab is, actually)"
8 | ,"description":"Header text for the localization section"
9 | }
10 | ,"l10nIntro": {
11 | "message":"'L10n' refers to 'Localization' - 'L' an 'n' are obvious, and 10 comes from the number of letters between those two. It is the process/whatever of displaying something in the language of choice. It uses 'I18n', 'Internationalization', which refers to the tools / framework supporting L10n. I.e., something is internationalized if it has I18n support, and can be localized. Something is localized for you if it is in your language / dialect."
12 | ,"description":"introduce the basic idea."
13 | }
14 | ,"l10nProd": {
15 | "message":"You are planning to allow localization, right? You have no idea who will be using your extension! You have no idea who will be translating it! At least support the basics, it's not hard, and having the framework in place will let you transition much more easily later on."
16 | ,"description":"drive the point home. It's good for you."
17 | }
18 | ,"l10nFirstParagraph": {
19 | "message":"When the options page loads, elements decorated with data-l10n will automatically be localized!"
20 | ,"description":"inform that elements will be localized on load"
21 | }
22 | ,"l10nSecondParagraph": {
23 | "message":"If you need more complex localization, you can also define data-l10n-args. This should contain $containerType$ filled with $dataType$, which will be passed into Chrome's i18n API as $functionArgs$. In fact, this paragraph does just that, and wraps the args in mono-space font. Easy!"
24 | ,"description":"introduce the data-l10n-args attribute. End on a lame note."
25 | ,"placeholders": {
26 | "containerType": {
27 | "content":"$1"
28 | ,"example":"'array', 'list', or something similar"
29 | ,"description":"type of the args container"
30 | }
31 | ,"dataType": {
32 | "content":"$2"
33 | ,"example":"string"
34 | ,"description":"type of data in each array index"
35 | }
36 | ,"functionArgs": {
37 | "content":"$3"
38 | ,"example":"arguments"
39 | ,"description":"whatever you call what you pass into a function/method. args, params, etc."
40 | }
41 | }
42 | }
43 | ,"l10nThirdParagraph": {
44 | "message":"Message contents are passed right into innerHTML without processing - include any tags (or even scripts) that you feel like. If you have an input field, the placeholder will be set instead, and buttons will have the value attribute set."
45 | ,"description":"inform that we handle placeholders, buttons, and direct HTML input"
46 | }
47 | ,"l10nButtonsBefore": {
48 | "message":"Different types of buttons are handled as well. <button> elements have their html set:"
49 | }
50 | ,"l10nButton": {
51 | "message":"in a button"
52 | }
53 | ,"l10nButtonsBetween": {
54 | "message":"while <input type='submit'> and <input type='button'> get their 'value' set (note: no HTML):"
55 | }
56 | ,"l10nSubmit": {
57 | "message":"a submit value"
58 | }
59 | ,"l10nButtonsAfter": {
60 | "message":"Awesome, no?"
61 | }
62 | ,"l10nExtras": {
63 | "message":"You can even set data-l10n on things like the <title> tag, which lets you have translatable page titles, or fieldset <legend> tags, or anywhere else - the default Boil.localize() behavior will check every tag in the document, not just the body."
64 | ,"description":"inform about places which may not be obvious, like , etc"
65 | }
66 | }
67 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # sonar.js
2 | A framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration, WebSocket host scanning, and external resource fingerprinting.
3 |
4 | ## How does it work?
5 | Upon loading the sonar.js payload in a modern web browser the following will happen:
6 | * sonar.js will use WebRTC to enumerate what internal IPs the user loading the payload has.
7 | * sonar.js then attempts to find live hosts on the internal network via WebSockets.
8 | * If a live host is found, sonar.js begins to attempt to fingerprint the host by linking to it via ```<img src="x">``` and ```<link rel="stylesheet" type="text/css" href="x">``` and hooking the ```onload``` event. If the expected resources load successfully it will trigger the pre-set JavaScript callback to start the user-supplied exploit.
9 |
10 | ## Fingerprints
11 | sonar.js works off of a database of fingerprints. A fingerprint is simply a list of known resources on a device that can be linked to and detected via ```onload```. Examples of this include images, CSS stylesheets, and even external JavaScript.
12 |
13 | An example fingerprint database can be seen below:
14 | ```
15 | var fingerprints = [
16 | {
17 | 'name': "ASUS RT-N66U",
18 | 'resources': ["/images/New_ui/asustitle.png","/images/loading.gif","/images/alertImg.png","/images/New_ui/networkmap/line_one.png","/images/New_ui/networkmap/lock.png","/images/New_ui/networkmap/line_two.png","/index_style.css","/form_style.css","/NM_style.css","/other.css"],
19 | 'callback': function( ip ) {
20 | // Insert exploit here
21 | },
22 | },
23 | {
24 | 'name': "Linksys WRT54G",
25 | 'resources': ["/UILinksys.gif","/UI_10.gif","/UI_07.gif","/UI_06.gif","/UI_03.gif","/UI_02.gif","/UI_Cisco.gif","/style.css"],
26 | 'callback': function( ip ) {
27 | // Insert exploit here
28 | },
29 | },
30 | ]
31 | ```
32 |
33 | The above database contains fingerprints for two devices, the *ASUS RT-N66U* WiFi router and the *Linksys WRT54G* WiFi router.
34 |
35 | Each database entry has the following:
36 | * ``name``: A field to identify what device the fingerprint is for. This could be something like *HP Officejet 4500 printer* or *Linksys WRT54G Router*.
37 | * ```resources```: This is an array of relative links to resources such as CSS stylesheets, images, or even JavaScript files. If you expect these resources to be on a non-standard port such as ``8080``, set the resource with the port included: ```:8080/unique.css```. Keep in mind using external resources with active content such as JavaScript is dangerous as it can interrupt the regular flow of execution.
38 | * ```callback```: If all of these resources are found to exist on the enumerated host then the ```callback``` function is called with a single argument of the device's IP address.
39 |
40 | By creating your own fingerprints you can build custom exploits that will be launched against internal devices once they are detected by sonar.js. Common exploits include things such as Cross-site Request Forgery (CSRF), Cross-site Scripting (XSS), etc. The idea being that you can use these vulnerabilities to do things such as modifying router DNS configurations, dumping files from an internal fileserver, and more.
41 |
42 | For an easier way to create fingerprints, see the following Chrome extension which generates fingerprint template code automatically for the page you're on:
43 |
44 | <a href="https://chrome.google.com/webstore/detail/sonar.js-fingerprint-generat/pmijnndljolchjlfcncaeoejfpjjagef">Click Here to Install Chrome Extension</a>
45 |
46 | 
47 |
48 | ## What can be done using sonar.js?
49 | By using sonar.js a pentesting team can build web exploits against things such as internal logging servers, routers, printers, VOIP phones, and more. Due to internal networks often being less guarded, attacks such as CSRF and XSS can be powerful to take over the configurations of devices on a hosts internal network. Did we mention this can all be done from an Internet webpage?
50 |
51 | ## Help us build our database!
52 | If you have a device such as a printer, router, or some other internal service please submit a fingerprint to us so we can add it to our master database. We will be adding more fingerprints for more devices overtime but we are limited to the devices that we have access to.
53 |
--------------------------------------------------------------------------------
/experiments/css_diff.htm:
--------------------------------------------------------------------------------
1 | <!DOCTYPE html>
2 | <html class="sonar_probe" lang="en-US">
3 | <meta class="sonar_probe" charset="UTF-8">
4 | <!-- This entire page is just a probe to diff CSS styles that get applied when you include an external stylesheet -->
5 | <head class="sonar_probe">
6 | </head>
7 | <body class="sonar_probe">
8 | <a class="sonar_probe" href="https://www.example.com/">Example</a>
9 | <abbr class="sonar_probe" title="Example">Example</abbr>
10 | <acronym class="sonar_probe" title="Example">Ex</acronym>
11 | <address class="sonar_probe">
12 | 1234 23rd St.
13 | Compton
14 | </address>
15 | <article class="sonar_probe">Example</article>
16 | <aside class="sonar_probe">Example</aside>
17 | <audio class="sonar_probe"></audio>
18 | <b class="sonar_probe">Example</b>
19 | <base class="sonar_probe" href="https://www.example.com/">
20 | <bdi class="sonar_probe">Example</bdi>
21 | <bdo class="sonar_probe">Example</bdo>
22 | <big class="sonar_probe">Example</big>
23 | <blockquote class="sonar_probe">Example</blockquote>
24 | <br class="sonar_probe" />
25 | <button class="sonar_probe" type="button">Example</button>
26 | <canvas class="sonar_probe"></canvas>
27 | <caption class="sonar_probe">Example</caption>
28 | <center class="sonar_probe">Example</center>
29 | <cite class="sonar_probe">Example</cite>
30 | <code class="sonar_probe">Example</code>
31 | <table class="sonar_probe">
32 | <colgroup class="sonar_probe">
33 | <col class="sonar_probe">
34 | </colgroup>
35 | <tr class="sonar_probe">
36 | <th class="sonar_probe">Example</th>
37 | </tr>
38 | <tr>
39 | <td class="sonar_probe">Example</td>
40 | </tr>
41 | <tfoot class="sonar_probe"></tfoot>
42 | </table>
43 | <datalist class="sonar_probe">
44 | <option value="Example">
45 | </datalist>
46 | <dl class="sonar_probe">
47 | <dt class="sonar_probe">Example</dt>
48 | <dd class="sonar_probe">Example</dd>
49 | </dl>
50 | <del class="sonar_probe">Example</del>
51 | <details class="sonar_probe">Example</details>
52 | <dfn class="sonar_probe">Example</dfn>
53 | <dialog class="sonar_probe">Example</dialog>
54 | <dir class="sonar_probe">Example</dir>
55 | <div class="sonar_probe">Example</div>
56 | <em class="sonar_probe">Example</em>
57 | <embed class="sonar_probe"></embed>
58 | <fieldset class="sonar_probe">Example</fieldset>
59 | <figure class="sonar_probe">
60 | <figcaption class="sonar_probe">Example</figcaption>
61 | </figure>
62 | <font class="sonar_probe">Example</font>
63 | <form class="sonar_probe"></form>
64 | <frameset class="sonar_probe">
65 | <frame class="sonar_probe" src="data:text/html,Example"></frame>
66 | </frameset>
67 | <h1 class="sonar_probe">Example</h1>
68 | <h2 class="sonar_probe">Example</h2>
69 | <h3 class="sonar_probe">Example</h3>
70 | <h4 class="sonar_probe">Example</h4>
71 | <h5 class="sonar_probe">Example</h5>
72 | <h6 class="sonar_probe">Example</h6>
73 | <header class="sonar_probe">Example</header>
74 | <hr class="sonar_probe">
75 | <i class="sonar_probe">Example</i>
76 | <iframe class="sonar_probe" src="data:text/html,Example"></iframe>
77 | <img class="sonar_probe" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABAQMAAAAl21bKAAAAA1BMVEX4/P+Jpl6OAAAAEklEQVR4XgXAgQgAAAAAoP2pjwACAAF0O1JHAAAAAElFTkSuQmCC">
78 | <input class="sonar_probe"></input>
79 | <ins class="sonar_probe">Example</ins>
80 | <kbd class="sonar_probe">Example</kbd>
81 | <keygen class="sonar_probe">
82 | <label class="sonar_probe">Example</label>
83 | <legend class="sonar_probe">Example</legend>
84 | <li class="sonar_probe">Example</li>
85 | <link class="sonar_probe" rel="stylesheet" type="text/css" href="data:text/css,">
86 | <main class="sonar_probe">Example</main>
87 | <mark class="sonar_probe">Example</mark>
88 | <menu class="sonar_probe" type="context">
89 | <menuitem class="sonar_probe">
90 | Example
91 | </menuitem>
92 | </menu>
93 | <meter class="sonar_probe" value="2" min="0" max="10">Example</meter>
94 | <nav class="sonar_probe"></nav>
95 | <noframes class="sonar_probe">Example</noframes>
96 | <noscript class="sonar_probe">Example</noscript>
97 | <object class="sonar_probe"><param class="sonar_probe"></param></object>
98 | <ol class="sonar_probe">Example</ol>
99 | <optgroup class="sonar_probe">Example</optgroup>
100 | <output class="sonar_probe">Example</output>
101 | <p class="sonar_probe">Example</p>
102 | <pre class="sonar_probe"></pre>
103 | <progress class="sonar_probe" value="22" max="100"></progress>
104 | <q class="sonar_probe">Example</q>
105 | <ruby class="sonar_probe">
106 | 漢 <rt class="sonar_probe"><rp class="sonar_probe">(</rp>ㄏㄢˋ<rp>)</rp></rt>
107 | </ruby>
108 | <s class="sonar_probe">Example</s>
109 | <samp class="sonar_probe">Example</samp>
110 | <script class="sonar_probe" src="data:text/javascript,[]"></script>
111 | <section class="sonar_probe">Example</section>
112 | <select class="sonar_probe"></select>
113 | <small class="sonar_probe">Example</small>
114 | <source class="sonar_probe"></source>
115 | <span class="sonar_probe">Example</span>
116 | <strike class="sonar_probe">Example</strike>
117 | <strong class="sonar_probe">Example</strong>
118 | <style class="sonar_probe"></style>
119 | <sub class="sonar_probe">Example</sub>
120 | <summary class="sonar_probe">Example</summary>
121 | <sup class="sonar_probe">Example</sup>
122 | <textarea class="sonar_probe"></textarea>
123 | <time class="sonar_probe">13:37</time>
124 | <title class="sonar_probe">Example
125 |
126 | Example
127 | Example
128 |