XSS-Dangling-Markup-server/server.js at main · mantapwak/XSS-Dangling-Markup-server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
const express = require('express');
const app = express();
const PORT = 3000;

// Simpan semua request yang masuk
let capturedData = [];

// Middleware untuk log semua request
app.use((req, res, next) => {
  const timestamp = new Date().toISOString();
  const fullUrl = req.protocol + '://' + req.get('host') + req.originalUrl;

  const logEntry = {
    timestamp,
    method: req.method,
    path: req.path,
    query: req.query,
    fullUrl: fullUrl,
    headers: req.headers,
    ip: req.ip
  };

  capturedData.push(logEntry);

  console.log('\n=== NEW REQUEST CAPTURED ===');
  console.log('Time:', timestamp);
  console.log('Full URL:', fullUrl);
  console.log('Query String:', req.originalUrl.split('?')[1] || 'none');
  console.log('===========================\n');

  next();
});

// Root endpoint - tangkap dangling markup
app.get('/', (req, res) => {
  res.status(200).send('Request captured!');
});

// Endpoint untuk melihat semua data yang tertangkap
app.get('/logs', (req, res) => {
  res.json({
    total: capturedData.length,
    data: capturedData
  });
});

// Endpoint untuk melihat logs dalam format HTML (lebih mudah dibaca)
app.get('/view', (req, res) => {
  let html = `
    <!DOCTYPE html>
    <html>
    <head>
      <title>Captured Data</title>
      <style>
        body { font-family: monospace; padding: 20px; background: #1e1e1e; color: #d4d4d4; }
        .entry { border: 1px solid #444; padding: 15px; margin: 10px 0; background: #252526; }
        .timestamp { color: #4ec9b0; font-weight: bold; }
        .url { color: #ce9178; word-break: break-all; }
        .flag { color: #4fc1ff; font-size: 18px; font-weight: bold; background: #264f78; padding: 5px; }
        h1 { color: #4ec9b0; }
        pre { background: #1e1e1e; padding: 10px; overflow-x: auto; }
      </style>
    </head>
    <body>
      <h1>🎯 Dangling Markup Capture Log</h1>
      <p>Total requests: ${capturedData.length}</p>
      <button onclick="location.reload()">Refresh</button>
      <hr>
  `;

  capturedData.reverse().forEach((entry, index) => {
    // Cari flag di query string
    const queryString = entry.fullUrl.split('?')[1] || '';
    const flagMatch = queryString.match(/value=([a-zA-Z0-9]+)/);
    const flag = flagMatch ? flagMatch[1] : null;

    html += `
      <div class="entry">
        <div class="timestamp">#${capturedData.length - index} - ${entry.timestamp}</div>
        <div><strong>Method:</strong> ${entry.method}</div>
        <div><strong>Path:</strong> ${entry.path}</div>
        ${flag ? `<div class="flag">🚩 FLAG FOUND: ${flag}</div>` : ''}
        <div><strong>Full URL:</strong></div>
        <div class="url">${entry.fullUrl}</div>
        <details>
          <summary>Raw Query String</summary>
          <pre>${queryString}</pre>
        </details>
      </div>
    `;
  });

  html += `
    </body>
    </html>
  `;

  res.send(html);
});

// Clear logs endpoint
app.get('/clear', (req, res) => {
  capturedData = [];
  res.send('Logs cleared! <a href="/view">Back to view</a>');
});

app.listen(PORT, () => {
  console.log(`🚀 Server running on http://localhost:${PORT}`);
  console.log(`📊 View logs at: http://localhost:${PORT}/view`);
  console.log(`🧹 Clear logs at: http://localhost:${PORT}/clear`);
  console.log('\n⏳ Waiting for dangling markup requests...\n');
});