Khata is a utility designed to keep records of all incoming HTTP requests in secure fashion. Khata is designed while keeping usability, security and ease of deployment in mind, So Khata is database free and only need few minutes to setup and starts working.
While working on my Attiny85 scripts I mostly rely on weebhook.site which is very useful and reliable but it's not mine. So, I always wanted to create something similar and one day I just sat and started working on it and piece by piece it turned into a complete project. So now I have my own webhook for my Attiny85 script but I can also use it to detect Cross Site Scripting (XSS) and Server-Side Request Forgery (SSRF) vulnerabilities.
Khata is written in PHP (Yes, I said PHP) because PHP is easily available on all hosting platforms and doesn’t need any fancy work. For making the utility fancy I have used Bootstrap and jQuery (it was a blast [cries inside]). To make data more user friendly I have used datatable plugin which is quite good and make work easy (I found that out after writing everything myself[stupid]). Thanks to datatable all logs can be download in CSV, XLSX, PDF format
For data security I am encrypting received request with AES-256-OFB and keeping them in a plain text file (Now don't be so melodramatic). From where C2 (index.php) picks up all the data decrypts it and present it in readable form. For C2 security I have tried to keep up with the security measures like Anti-CSRF, Captcha, Security Headers, and other stuff I can't remember. (If you have any suggestions to improve security put them in suggestion box).
docker pull mtk911/khata
docker run -d -p 80:80 mtk911/khata
Deploying khata is super easy you just need to have and do few things:
- A Server Apache/Nginx etc
- PHP installation (Tested it on PHP>7)
- Copy all three php files to server root directory
Done
- Change Username and Password(Make sure it is SHA256 in lowercase i don't know why lowercase) in configuration file
- Change Key and IV in configuration file for encryption
- Change file name of logs and responder in configuration file
- Change random1 and random2 variable
- Make sure catch.php has permission to write in directory
- Change time zone in configuration file
- Use .htaccess to restrict access to data file and configuration.php file
- For security reason log file size is limited to 1 GB you can change it to whatever you want
Khata can be use to detect XSS and SSRF using Khata as a listener. For XSS place Khata in script tag source <script src="http://abc.xyz/catch.php"> in case of XSS vulnerability you will be able to see a log entry in C2. For SSRF visit following blog. Using responder function you can define your own response which turns KHATA into multi-function tool and sky is the limit.
index.php: C2 where you view all data
catch.php: Request collector where you point all your requests to
configuration.php: It is self-explanatory
admin/admin
All the software/scripts/applications/things in this repository are provided as is, without warranty of any kind. Use of these software/scripts/applications/things is entirely at your own risk. Creator of these softwares/scripts/applications/things is not responsible for any direct or indirect damage to your own or defiantly someone else's property resulting from the use of these software/scripts/applications/things.
MIT License
Copyright (c) 2020 Muhammad Talha Khan
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- Added responder functionality to display or execute custom payloads on catch.php response
- Captcha turned to image for better security
- CSS changes for UI improvement