BlueLotus_XSSReceiver/login.php

<?php
define("IN_XSS_PLATFORM", true);

require_once("load.php");
require_once("functions.php");

//CSP开启
header("Content-Security-Policy: default-src 'self'; object-src 'none'; frame-src 'none'");
header("X-Content-Security-Policy: default-src 'self'; object-src 'none'; frame-src 'none'");
header("X-WebKit-CSP: default-src 'self'; object-src 'none'; frame-src 'none'");

//设置httponly
ini_set("session.cookie_httponly", 1);
session_start();


//判断是否登陆
if (isset($_SESSION['isLogin']) && $_SESSION['isLogin'] === true) {
    header("Location: admin.php");
    exit();
}

//判断ip是否在封禁列表中
$forbiddenIPList = loadForbiddenIPList();
$ip              = $_SERVER['REMOTE_ADDR'];
$is_pass_wrong   = false;
if (!isset($forbiddenIPList[$ip]) || $forbiddenIPList[$ip] <= 5) {
    if (isset($_POST['password']) && $_POST['password'] != "") {
        if (checkPassword($_POST['password'])) {
            $_SESSION['isLogin']    = true;
            $_SESSION['user_IP']    = $ip;
            $_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'];
            if (isset($forbiddenIPList[$ip])) {
                unset($forbiddenIPList[$ip]);
                saveForbiddenIPList($forbiddenIPList);
            }
            header("Location: admin.php");
            exit();
        } else {
            if (isset($forbiddenIPList[$ip]))
                $forbiddenIPList[$ip]++;
            else
                $forbiddenIPList[$ip] = 1;
            saveForbiddenIPList($forbiddenIPList);
            $is_pass_wrong = true;
        }
    }
} else
    $is_pass_wrong = true;

function loadForbiddenIPList() {
    $logfile = DATA_PATH . '/forbiddenIPList.dat';
    !file_exists($logfile) && @touch($logfile);
    $str = @file_get_contents($logfile);
    if ($str === false)
        return array();
    
    $str = decrypt($str);
    
    
    if ($str != '') {
        $result = json_decode($str, true);
        if ($result != null)
            return $result;
        else
            return array();
    } else
        return array();
}

function saveForbiddenIPList($forbiddenIPList) {
    $logfile = DATA_PATH . '/forbiddenIPList.dat';
    !file_exists($logfile) && @touch($logfile);
    $str = json_encode($forbiddenIPList);
    $str = encrypt($str);
    @file_put_contents($logfile, $str);
}

/*
生成密码
php -r "$salt='!KTMdg#^^I6Z!deIVR#SgpAI6qTN7oVl';$key='bluelotus';$key=md5($salt.$key.$salt);$key=md5($salt.$key.$salt);$key=md5($salt.$key.$salt);echo $key;"
*/
function checkPassword($p) {
    if (isset($_POST['firesunCheck']) && isset($_SESSION['firesunCheck']) && $_SESSION['firesunCheck'] != "" && $_POST['firesunCheck'] === $_SESSION['firesunCheck']) {
        //改了这个盐记得改login.js里的，两个要一致
        $salt = "!KTMdg#^^I6Z!deIVR#SgpAI6qTN7oVl";
        $key  = PASS;
        $key  = md5($salt . $key . $_SESSION['firesunCheck'] . $salt);
        $key  = md5($salt . $key . $_SESSION['firesunCheck'] . $salt);
        $key  = md5($salt . $key . $_SESSION['firesunCheck'] . $salt);
        return $key === $p;
    }
    return false;
}

//生成挑战应答的随机值
function generate_password($length = 32) {
    $chars    = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
    $password = "";
    for ($i = 0; $i < $length; $i++)
        $password .= $chars[mt_rand(0, strlen($chars) - 1)];
    return $password;
}
?>

<html>
    <head>
        <meta charset="utf-8" />
		<title>登录</title>
		<link rel="stylesheet" href='static/css/font-awesome.min.css' type="text/css" >
		<link rel="stylesheet" href="static/css/login.min.css" type="text/css" />
		
        <script type="text/javascript" src="static/js/jquery.min.js" ></script>
        <script type="text/javascript" src="static/js/login.min.js" ></script>
		<?php
if ($is_pass_wrong)
    echo '<script type="text/javascript" src="static/js/pass_is_wrong.js" ></script>';
?>
    </head>
    
    <body>
        <div id="loginform">
			<div id="logo"></div>
            <div id="mainlogin">
                <h1>
                    登录控制面板
                </h1>
                <form action="" method="post">
                    <input type="password" placeholder="password" id="password" name="password" required="required">
					<input id="firesunCheck" type="hidden" name="firesunCheck" value=<?php
$firesunCheck             = generate_password(32);
$_SESSION['firesunCheck'] = $firesunCheck;
echo json_encode($_SESSION['firesunCheck']);
?> />
                    
					<button type="submit" id="submit" disabled="disabled">
                        <i class="fa fa-arrow-right">
                        </i>
                    </button>
					
                </form>
                <div id="note">
                    <a href="#">
                        忘记密码?
                    </a>
                </div>
            </div>
        </div>
    </body>

</html>
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								<?php
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+								define("IN_XSS_PLATFORM", true);
 								require_once("load.php");
 								require_once("functions.php");
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								//CSP开启
 								header("Content-Security-Policy: default-src 'self'; object-src 'none'; frame-src 'none'");
 								header("X-Content-Security-Policy: default-src 'self'; object-src 'none'; frame-src 'none'");
 								header("X-WebKit-CSP: default-src 'self'; object-src 'none'; frame-src 'none'");
-												Version 2.2.2
增加注销按钮
完善注释

											
										
										
											2015-10-30 22:46:04 +08:00
+								//设置httponly
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+								ini_set("session.cookie_httponly", 1);
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								session_start();
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
-												Version 2.2.2
增加注销按钮
完善注释

											
										
										
											2015-10-30 22:46:04 +08:00
+								//判断是否登陆
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+								if (isset($_SESSION['isLogin']) && $_SESSION['isLogin'] === true) {
 								    header("Location: admin.php");
 								    exit();
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								}
-												Version 2.2.2
增加注销按钮
完善注释

											
										
										
											2015-10-30 22:46:04 +08:00
+								//判断ip是否在封禁列表中
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+								$forbiddenIPList = loadForbiddenIPList();
 								$ip              = $_SERVER['REMOTE_ADDR'];
 								$is_pass_wrong   = false;
 								if (!isset($forbiddenIPList[$ip]) || $forbiddenIPList[$ip] <= 5) {
 								    if (isset($_POST['password']) && $_POST['password'] != "") {
 								        if (checkPassword($_POST['password'])) {
 								            $_SESSION['isLogin']    = true;
 								            $_SESSION['user_IP']    = $ip;
 								            $_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'];
 								            if (isset($forbiddenIPList[$ip])) {
 								                unset($forbiddenIPList[$ip]);
 								                saveForbiddenIPList($forbiddenIPList);
 								            }
 								            header("Location: admin.php");
 								            exit();
 								        } else {
 								            if (isset($forbiddenIPList[$ip]))
 								                $forbiddenIPList[$ip]++;
 								            else
 								                $forbiddenIPList[$ip] = 1;
 								            saveForbiddenIPList($forbiddenIPList);
 								            $is_pass_wrong = true;
 								        }
 								    }
 								} else
 								    $is_pass_wrong = true;
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
-												Version 3.3.1
代码格式化

											
										
										
											2016-01-28 11:27:27 +08:00
+								function loadForbiddenIPList() {
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+								    $logfile = DATA_PATH . '/forbiddenIPList.dat';
 								    !file_exists($logfile) && @touch($logfile);
 								    $str = @file_get_contents($logfile);
 								    if ($str === false)
 								        return array();
 								    $str = decrypt($str);
 								    if ($str != '') {
 								        $result = json_decode($str, true);
 								        if ($result != null)
 								            return $result;
 								        else
 								            return array();
 								    } else
 								        return array();
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								}
-												Version 3.3.1
代码格式化

											
										
										
											2016-01-28 11:27:27 +08:00
+								function saveForbiddenIPList($forbiddenIPList) {
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+								    $logfile = DATA_PATH . '/forbiddenIPList.dat';
 								    !file_exists($logfile) && @touch($logfile);
 								    $str = json_encode($forbiddenIPList);
 								    $str = encrypt($str);
 								    @file_put_contents($logfile, $str);
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								}
 								/*
 								生成密码
 								php -r "$salt='!KTMdg#^^I6Z!deIVR#SgpAI6qTN7oVl';$key='bluelotus';$key=md5($salt.$key.$salt);$key=md5($salt.$key.$salt);$key=md5($salt.$key.$salt);echo $key;"
 								*/
-												Version 3.3.1
代码格式化

											
										
										
											2016-01-28 11:27:27 +08:00
+								function checkPassword($p) {
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+								    if (isset($_POST['firesunCheck']) && isset($_SESSION['firesunCheck']) && $_SESSION['firesunCheck'] != "" && $_POST['firesunCheck'] === $_SESSION['firesunCheck']) {
 								        //改了这个盐记得改login.js里的，两个要一致
 								        $salt = "!KTMdg#^^I6Z!deIVR#SgpAI6qTN7oVl";
 								        $key  = PASS;
 								        $key  = md5($salt . $key . $_SESSION['firesunCheck'] . $salt);
 								        $key  = md5($salt . $key . $_SESSION['firesunCheck'] . $salt);
 								        $key  = md5($salt . $key . $_SESSION['firesunCheck'] . $salt);
 								        return $key === $p;
 								    }
 								    return false;
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								}
-												Version 2.2.2
增加注销按钮
完善注释

											
										
										
											2015-10-30 22:46:04 +08:00
+								//生成挑战应答的随机值
-												Version 3.3.1
代码格式化

											
										
										
											2016-01-28 11:27:27 +08:00
+								function generate_password($length = 32) {
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+								    $chars    = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
 								    $password = "";
 								    for ($i = 0; $i < $length; $i++)
 								        $password .= $chars[mt_rand(0, strlen($chars) - 1)];
 								    return $password;
 								}
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								?>
 								<html>
 								    <head>
 								        <meta charset="utf-8" />
 										<title>登录</title>
-												Version 3.3.3
压缩与合并js与css文件，js与src原文件移至src目录下

											
										
										
											2016-01-30 00:03:47 +08:00
+										<link rel="stylesheet" href='static/css/font-awesome.min.css' type="text/css" >
 										<link rel="stylesheet" href="static/css/login.min.css" type="text/css" />
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
 								        <script type="text/javascript" src="static/js/jquery.min.js" ></script>
-												Version 3.3.3
压缩与合并js与css文件，js与src原文件移至src目录下

											
										
										
											2016-01-30 00:03:47 +08:00
+								        <script type="text/javascript" src="static/js/login.min.js" ></script>
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+										<?php
 								if ($is_pass_wrong)
 								    echo '<script type="text/javascript" src="static/js/pass_is_wrong.js" ></script>';
 								?>
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								    </head>
 								    <body>
 								        <div id="loginform">
 											<div id="logo"></div>
 								            <div id="mainlogin">
 								                <h1>
 								                    登录控制面板
 								                </h1>
 								                <form action="" method="post">
 								                    <input type="password" placeholder="password" id="password" name="password" required="required">
-												Version 3.3.0
添加安装脚本install.php

											
										
										
											2016-01-28 02:19:09 +08:00
+													<input id="firesunCheck" type="hidden" name="firesunCheck" value=<?php
 								$firesunCheck             = generate_password(32);
 								$_SESSION['firesunCheck'] = $firesunCheck;
 								echo json_encode($_SESSION['firesunCheck']);
 								?> />
-												Version 3.0.0
1. 完成js模板，我的js模块，可以直接添加修改用于xss的js
2. 采用ace编辑器实现js代码高亮与错误检测
3. 使用js_beautify实现js代码格式化，使用jsmin实现js代码压缩
4. 整合xss'or工具部分功能，自由编码，方便生成最终的payload
5. 增加加密方式RC4，更改默认加密方式为RC4
6. 从旧版本升级并想保留记录的请务必查看Readme里的升级步骤
7. 修复一系列bug

											
										
										
											2016-01-24 01:07:17 +08:00
 													<button type="submit" id="submit" disabled="disabled">
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								                        <i class="fa fa-arrow-right">
 								                        </i>
 								                    </button>
-												Version 3.0.0
1. 完成js模板，我的js模块，可以直接添加修改用于xss的js
2. 采用ace编辑器实现js代码高亮与错误检测
3. 使用js_beautify实现js代码格式化，使用jsmin实现js代码压缩
4. 整合xss'or工具部分功能，自由编码，方便生成最终的payload
5. 增加加密方式RC4，更改默认加密方式为RC4
6. 从旧版本升级并想保留记录的请务必查看Readme里的升级步骤
7. 修复一系列bug

											
										
										
											2016-01-24 01:07:17 +08:00
-												Version 2.2
增加登录界面与登录校验

											
										
										
											2015-10-29 00:57:57 +08:00
+								                </form>
 								                <div id="note">
 								                    <a href="#">
 								                        忘记密码?
 								                    </a>
 								                </div>
 								            </div>
 								        </div>
 								    </body>
 								</html>