Repository navigation
Expand file tree
/
Copy pathrecon-hell.html
More file actions
128 lines (119 loc) · 5.42 KB
/
Copy pathrecon-hell.html
File metadata and controls
128 lines (119 loc) · 5.42 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Recon Hell v3.0: The Infinite Header</title>
<meta name="generator" content="Magento 2.4.7">
<meta name="generator" content="BigCommerce">
<meta name="generator" content="Salesforce Commerce Cloud">
<meta name="generator" content="SAP Commerce Cloud">
<meta name="generator" content="Oracle NetSuite">
<meta name="generator" content="PrestaShop 8.0">
<meta name="generator" content="Zen Cart">
<meta name="generator" content="CubeCart">
<meta name="generator" content="X-Cart">
<meta name="generator" content="CS-Cart">
<meta name="generator" content="nopCommerce">
<meta name="generator" content="Volusion">
<meta name="generator" content="3dcart">
<meta name="generator" content="Ecwid">
<meta name="generator" content="Big Cartel">
<meta name="generator" content="Miva Merchant">
<meta name="generator" content="AmeriCommerce">
<meta name="generator" content="CoreCommerce">
<meta name="generator" content="Fortune3">
<meta name="generator" content="PinnacleCart">
<meta name="generator" content="ShopSite">
<meta name="generator" content="Quick eSelling">
<meta name="generator" content="LemonStand">
<meta name="generator" content="Selz">
<meta name="generator" content="Gumroad">
<meta name="generator" content="SendOwl">
<meta name="generator" content="FetchApp">
<meta name="generator" content="DPD (Digital Product Delivery)">
<meta name="generator" content="E-junkie">
<meta name="generator" content="Payloadz">
<meta name="apple-mobile-web-app-title" content="Internal Admin">
<meta name="application-name" content="CTF_Infra_Monitor">
<meta name="msapplication-TileColor" content="#da532c">
<meta name="theme-color" content="#ffffff">
<meta name="x-ua-compatible" content="IE=edge,chrome=1">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="referrer" content="no-referrer-when-downgrade">
<meta name="robots" content="noindex, nofollow, noarchive, nosnippet, notranslate, noimageindex">
<meta name="product-id" content="SKU-99283-A">
<meta name="product-id" content="SKU-99283-B">
<meta name="product-id" content="SKU-99283-C">
<meta name="product-id" content="SKU-99283-D">
<meta name="product-id" content="SKU-10293-X">
<meta name="product-id" content="SKU-10293-Y">
<meta name="product-id" content="SKU-10293-Z">
<meta name="product-id" content="SKU-55443-P">
<meta name="product-id" content="SKU-55443-Q">
<meta name="product-id" content="SKU-55443-R">
<link rel="dns-prefetch" href="//internal-db.ec2.aws.amazon.com">
<link rel="dns-prefetch" href="//s3-us-west-2.amazonaws.com/recon-private-data">
<link rel="dns-prefetch" href="//vault.hashicorp.internal">
<link rel="dns-prefetch" href="//kubernetes-master.cluster.local">
<link rel="dns-prefetch" href="//metrics.datadoghq.com">
<link rel="dns-prefetch" href="//logs.collector.splunk.internal">
<link rel="preconnect" href="https://api.stripe.com">
<link rel="preconnect" href="https://api.braintreegateway.com">
<link rel="preconnect" href="https://checkout.paypal.com">
<link rel="preconnect" href="https://connect.facebook.net">
<link rel="preconnect" href="https://google-analytics.com">
<script type="application/ld+json">
[
{
"@context": "https://schema.org",
"@type": "Organization",
"name": "Global Recon Corp",
"url": "http://10.0.0.1/hidden",
"logo": "http://1.1.1.1/logo.png",
"contactPoint": {
"@type": "ContactPoint",
"telephone": "+1-800-555-0199",
"contactType": "customer service"
}
},
{
"@context": "https://schema.org",
"@type": "WebSite",
"name": "Recon Portal",
"potentialAction": {
"@type": "SearchAction",
"target": "https://internal.recon.ctf/search?q={search_term_string}",
"query-input": "required name=search_term_string"
}
}
/* ... 80 more schema objects go here ... */
]
</script>
<script>
const bucketList = ["recon-backups", "prod-secrets", "dev-logs", "user-data-dump"];
const internalNodes = ["192.168.1.10", "192.168.1.11", "172.16.0.5", "10.10.10.50"];
// Populate cookies with garbage to hide the session
for (let i = 0; i < 250; i++) {
document.cookie = `RECON_DATA_${i}=${btoa(Math.random().toString())}; Max-Age=3600; path=/`;
}
</script>
</head>
<body>
<h1>hshbs</h1>
<p>man.</p>
<div id="catalog" style="opacity: 0.01;">
<div class="item" data-sku="RECON-001" data-price="99.99">ajdb</div>
<div class="item" data-sku="RECON-002" data-price="45.50">dshbd</div>
<div class="item" data-sku="RECON-003" data-price="12.00">ajbsahbs</div>
</div>
<script>
// This generates "activity" in the console to distract users
setInterval(() => {
const noise = ["Ping...","Auth heartbeat...","Syncing DB...","Check S3..."];
const randomMsg = noise[Math.floor(Math.random() * noise.length)];
const fakeHash = Array.from({length:32},()=>Math.floor(Math.random()*16).toString(16)).join('');
console.log(`[${new Date().toISOString()}] ${randomMsg} ID: ${fakeHash}`);
}, 5000);
</script>
</body>
</html>