shake-logger

This project provides a logger and a connected harlem shake js. The shake logger runs on port 8080, make sure that it is not blocked.

Please enable autoplay in your browser.

Instructions

This projects helps in awareness trainings, especially with the juice shop. You can use it via docker and docker-compose running: docker-compose up

To show the possible impact of XSS, follow these steps:

Assume you received and (of course) clicked this inconspicuous phishing link in some phishing email
Enjoy the music and animation! Wait until the music stops.
Search for some products or make any other interactions with the Juice Shop applications.
In another browser window (pretending to switch now to the view of the attacker) open the remote input logger that was also installed while the music & animation were playing. Observe that all input of the user is being captured and sent here. It refreshes every 5 seconds. This could easily run on a 3rd party server in real life!
Back in the Juice Shop, log in with any user account.
In the attacker's logger, you will now not only see the captured input, but also the session information of the user, including their JWT token.

You can also find a recording (from an older version) of this attack in action on YouTube: 📺