From cae10fcf94e3655fb4e6c3973c5732fcf70d14fa Mon Sep 17 00:00:00 2001 From: mia21 Date: Thu, 21 Mar 2019 04:48:21 +0000 Subject: [PATCH 1/3] Upload files to 'ismitmlink' --- ismitmlink/bg.js | 73 ++++++++++++++++++++++++++-------------- ismitmlink/cs.js | 12 ++++--- ismitmlink/manifest.json | 8 +++-- 3 files changed, 60 insertions(+), 33 deletions(-) diff --git a/ismitmlink/bg.js b/ismitmlink/bg.js index 5e575692..87a73de7 100644 --- a/ismitmlink/bg.js +++ b/ismitmlink/bg.js @@ -1,7 +1,6 @@ const apiurl = 'https://searxes.danwin1210.me/collab/open/ismitm.php'; -let mymemory = {}; -function ismitm(f) { +function is_infected(f) { return new Promise((g, b) => { fetch(apiurl, { method: 'POST', @@ -22,29 +21,51 @@ function ismitm(f) { }); } -browser.runtime.onMessage.addListener((request, sender, sendResponse) => { - if (request && sender) { - if (mymemory[request] != undefined) { - let rlt = mymemory[request]; - if (Object.keys(mymemory).length > 20000) { - let cnt = 1; - for (let t in mymemory) { - if (cnt > 10) { - break; - } - mymemory[t] = null; - delete mymemory[t]; - cnt++; - } - } - browser.tabs.sendMessage(sender.tab.id, [request, rlt]); - } else { - ismitm(request).then(function (a) { - mymemory[request] = a; - browser.tabs.sendMessage(sender.tab.id, [request, a]); - }, function () { - browser.tabs.sendMessage(sender.tab.id, [request, false]); - }); - } +function i_already_know_you(f) { + if (!/^([a-z0-9_.-]{1,255})\.([a-z]{2,80})$/.test(f)) { + return false; } + return new Promise((g, b) => { + browser.storage.local.get(f).then((ff) => { + if (ff[f]) { + if (ff[f] == 'y') { + g(1); + } else { + g(-1); + } + } else { + g(0); + } + }, () => { + g(0); + }); + }); +} + +function i_remember_you(f, t) { + browser.storage.local.set({ + [f]: ((t) ? 'y' : 'n') + }); +} + +browser.storage.local.clear().then(() => { + browser.runtime.onMessage.addListener((request, sender, sendResponse) => { + if (request && sender) { + i_already_know_you(request).then((r) => { + if (r == 1 || r == -1) { + browser.tabs.sendMessage(sender.tab.id, [request, ((r == 1) ? true : false)]); + } + if (r == 0) { + is_infected(request).then((a) => { + i_remember_you(request, a); + browser.tabs.sendMessage(sender.tab.id, [request, a]); + }, () => { + browser.tabs.sendMessage(sender.tab.id, [request, false]); + }); + } + }, () => {}); + } + }); +}, (e) => { + console.log(e); }); \ No newline at end of file diff --git a/ismitmlink/cs.js b/ismitmlink/cs.js index b28b81ef..c274e3b6 100644 --- a/ismitmlink/cs.js +++ b/ismitmlink/cs.js @@ -1,5 +1,5 @@ if (document.body) { - if (!['searxes.danwin1210.me', 'searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion', 'searxes.cyb'].includes(location.hostname)) { + if (!['searxes.danwin1210.me', 'searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion', 'searxes.cyb', 'addons.mozilla.org'].includes(location.hostname)) { let cs = (function () { let s = document.createElement('style'); document.head.appendChild(s); @@ -7,12 +7,14 @@ if (document.body) { })(); if (cs) { cs.insertRule("a[data-mitm]{text-decoration-line:line-through !important;text-decoration-color:red !important;text-decoration-style:double !important}", 0); - cs.insertRule("a[data-mitm]::after{content:'[MITM!]';font-weight:bold}", 1); + cs.insertRule("a[data-mitm]::before{content:'[MITM!]';font-weight:bold !important;color:red !important}", 1); + cs.insertRule("a[data-mitm]:hover::before{content:'[Privacy Risk!!]'}", 2); + cs.insertRule("a[data-mitm]:hover{color:red !important}", 3); } - let asked = [location.hostname, 'searxes.danwin1210.me', 'searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion', 'searxes.cyb']; + let asked = ['searxes.danwin1210.me', 'searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion', 'searxes.cyb']; document.querySelectorAll("a[href^='http://']:not([data-mitm]),a[href^='https://']:not([data-mitm]),a[href^='//']:not([data-mitm])").forEach(a => { let aF = (new URL(a.href)).hostname; - if (!/^(.*)\.(onion|i2p|invalid|test|local|localhost|([0-9]{1,3}))$/.test(aF) && !asked.includes(aF)) { + if (!/^(.*)\.(onion|i2p|invalid|test|local|localhost|([0-9]{1,3})|bbs|chan|cyb|dyn|geek|gopher|indy|libre|neo|null|o|oss|oz|parody|pirate|bit|lib|coin|emc|bazar|fur)$/.test(aF) && !asked.includes(aF)) { asked.push(aF); browser.runtime.sendMessage(aF); } @@ -22,7 +24,7 @@ if (document.body) { if (request[1]) { document.querySelectorAll("a[href^='http://" + request[0] + "/']:not([data-mitm]),a[href^='https://" + request[0] + "/']:not([data-mitm]),a[href^='//" + request[0] + "/']:not([data-mitm])").forEach(a => { a.dataset.mitm = 1; - a.title = 'MITM!'; + a.title = 'DANGER! DANGER! MITM!'; }); } } diff --git a/ismitmlink/manifest.json b/ismitmlink/manifest.json index 885e2004..7c851fa4 100644 --- a/ismitmlink/manifest.json +++ b/ismitmlink/manifest.json @@ -2,9 +2,13 @@ "manifest_version": 2, "name": "Are links vulnerable to MITM attack?", "description": "Scan FQDN using Searxes' API", - "version": "1.0.2", + "version": "1.0.3", + "homepage_url": "https://notabug.org/themusicgod1/cloudflare-tor/src/master/ismitmlink", "author": "Maslin Bossé", - "permissions": [], + "permissions": [ + "storage", + "unlimitedStorage" + ], "icons": { "32": "icons/32.png" }, From af04186e9e5b5160cf3fc4a2ab207f19db6ecbd8 Mon Sep 17 00:00:00 2001 From: mia21 Date: Thu, 21 Mar 2019 04:54:02 +0000 Subject: [PATCH 2/3] Update 'what-to-do.md' --- what-to-do.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/what-to-do.md b/what-to-do.md index 6c896598..68c5a418 100644 --- a/what-to-do.md +++ b/what-to-do.md @@ -98,6 +98,12 @@ If Cloudflare leak your information, it's not our fault. [*] - Do you need HTTPS certificate? Use "[Let's Encrypt](https://letsencrypt.org/)" or just buy it from CA company. +- Do you need DNS server? Can't set up your own server? Then how about [Dyn.com](https://dyn.com/dns/), [Hurricane Electric Free DNS](https://dns.he.net/) or [this](https://freedns.afraid.org/)? + +- Looking for hosting service? "Free" only? Well, [how about this](https://www.reddit.com/r/webdev/comments/5m8tr4/how_do_i_host_the_website_i_just_built/dc1qpk7/)? + +- Are you using "cloudflare-ipfs.com"? Do you know [Cloudflare IPFS is bad](https://ieji.de/@crimeflare/101779952797884218)? + - Install Web Application Firewall (such as OWASP) and Fail2Ban on _your_ server and configure it _properly_. - Set up [Tor Onion Service](https://www.torproject.org/docs/onion-services.html.en) or I2P insite if you believe in freedom and welcome anonymous users. From 54800895a494c9542030f5d76e1d65a43029f895 Mon Sep 17 00:00:00 2001 From: mia21 Date: Thu, 21 Mar 2019 04:58:19 +0000 Subject: [PATCH 3/3] Update 'what-to-do.md' --- what-to-do.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/what-to-do.md b/what-to-do.md index 68c5a418..0e68e6fc 100644 --- a/what-to-do.md +++ b/what-to-do.md @@ -72,9 +72,9 @@ If Cloudflare leak your information, it's not our fault. [*] | [Block Cloudflare MITM Attack](https://trac.torproject.org/projects/tor/attachment/ticket/24351/block_cloudflare_mitm_attack-1.0.14.1-an%2Bfx.xpi) | nullius | [Link](https://github.com/nym-zone/block_cloudflare_mitm_fx) | **Yes** | **Yes** | | [Are links vulnerable to MITM?](https://addons.mozilla.org/en-US/firefox/addon/are-links-vulnerable-to-mitm/) | Maslin Bossé | [Link](https://notabug.org/themusicgod1/cloudflare-tor/src/master/ismitmlink) | No | **Yes** | | [Third-party Request Blocker (AMO)](https://addons.mozilla.org/en-US/firefox/addon/tprb/) | Searxes #Addon | [Link](https://searxes.danwin1210.me/) | **Yes** | **Yes** | -| [TPRB](https://searxes.danwin1210.me/collab/tprb0/get_tprb0.php) | Sw | [Link](http://searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion/collab/___go.php?go=sw) | **Yes** | **Yes** | +| [TPRB](https://sw.skusklxqaqnrmszytky4vfyrg625erw4hqhiokyc2ufnokd2aitb47yd.onion/) | Sw | [Link](https://sw.skusklxqaqnrmszytky4vfyrg625erw4hqhiokyc2ufnokd2aitb47yd.onion/) | **Yes** | **Yes** | | [Detect Cloudflare](https://addons.mozilla.org/en-US/firefox/addon/detect-cloudflare/) | Frank Otto | [Link](https://github.com/traktofon/cf-detect) | No | **Yes** | -| [Cloud Firewall](https://addons.mozilla.org/en-US/firefox/addon/cloud-firewall/) [*] | Gokulakrishna Sudharsan | [Link](https://gitlab.com/gkrishnaks/cloud-firewall/) | Yes | No | +| [Cloud Firewall](https://addons.mozilla.org/en-US/firefox/addon/cloud-firewall/) [*] | Gokulakrishna Sudharsan | [Link](https://gitlab.com/gkrishnaks/cloud-firewall/) | **Yes** | No | [*] Do not use it if you're using proxy/VPN/Tor because it has "[DNS leak](https://en.wikipedia.org/wiki/DNS_leak)".