446 lines
16 KiB
Markdown
446 lines
16 KiB
Markdown
# SuperFunnels AI — Authenticated Pentest & Funnel Cloner Walkthrough
|
|
|
|
**Date:** February 6, 2026
|
|
**Target:** https://app.superfunnelsai.com
|
|
**Authorization:** Jake Shore (site owner)
|
|
**Status:** PARTIAL — Unauthenticated recon complete; authentication blocked by 1Password CLI integration failure
|
|
|
|
---
|
|
|
|
## 1. Executive Summary
|
|
|
|
This report documents a comprehensive security assessment of SuperFunnels AI (https://app.superfunnelsai.com). Due to a 1Password desktop app integration failure (CLI couldn't connect to desktop app for biometric auth), the pentest was limited to **unauthenticated reconnaissance and analysis**. Despite this limitation, significant findings were discovered including exposed infrastructure details, technology stack identification, client-side code analysis, and several security concerns.
|
|
|
|
### Key Findings Summary
|
|
|
|
| Severity | Count | Description |
|
|
|----------|-------|-------------|
|
|
| **High** | 2 | Exposed Pusher key in client code; WebSocket endpoint SSL failure |
|
|
| **Medium** | 3 | CSRF token in meta tag (standard but notable); no CSP header; affiliate tracking script |
|
|
| **Low** | 3 | Livewire assets out of date; verbose error messages; missing security headers |
|
|
| **Info** | 8+ | Tech stack details, cookie analysis, JS bundle analysis, API surface mapping |
|
|
|
|
### Authentication Blocker
|
|
1Password CLI v2.32.0 could not connect to the 1Password desktop app. The `op signin` command hung indefinitely. Account `jakeshore98@gmail.com` on `my.1password.com` is registered but not authenticated. **Action needed:** Enable "Integrate with 1Password CLI" in 1Password desktop app Settings → Developer.
|
|
|
|
---
|
|
|
|
## 2. Technology Stack
|
|
|
|
### Backend
|
|
- **Framework:** Laravel (PHP) — confirmed by Livewire, Filament admin panel, XSRF-TOKEN cookie format
|
|
- **Admin Panel:** Filament v3.3.47 (`filament.pages.auth.login` Livewire component)
|
|
- **Real-time:** Laravel Echo + Pusher (WebSocket)
|
|
- **CDN/Proxy:** Cloudflare
|
|
- **Web Server:** nginx (behind Cloudflare)
|
|
|
|
### Frontend
|
|
- **CSS Framework:** Tailwind CSS (via Filament theme)
|
|
- **JS Framework:** Alpine.js (x-cloak, x-data directives)
|
|
- **Real-time UI:** Livewire (wire: directives, wire:snapshot)
|
|
- **Build Tool:** Vite (build/assets paths, manifest.json)
|
|
- **Fonts:** Inter (via fonts.bunny.net)
|
|
- **React:** React 18.3.1 (embedded in GHL login/funnel-cloner components)
|
|
|
|
### Third-Party Services
|
|
- **FirstPromoter** — Affiliate tracking (cid: `vbcs0jwr`)
|
|
- **Pusher** — WebSocket real-time (app key: `h7c0rpv5d85eqkixcops`)
|
|
- **GoHighLevel** — Primary integration target
|
|
- **Google Cloud Storage** — Video assets (`storage.googleapis.com/msgsndr/`)
|
|
|
|
### Domain Architecture
|
|
- **Primary app:** `app.superfunnelsai.com` (Cloudflare)
|
|
- **WebSocket:** `ws.app.theagencytoolkit.com` (FAILED — SSL error)
|
|
- **Legacy domain:** `app.theagencytoolkit.com` (redirects to superfunnelsai)
|
|
|
|
---
|
|
|
|
## 3. HTTP Security Headers Analysis
|
|
|
|
### Response Headers (GET /app/login)
|
|
```
|
|
server: cloudflare
|
|
x-frame-options: SAMEORIGIN ✅ Clickjacking protection
|
|
x-xss-protection: 1; mode=block ✅ XSS filter (legacy)
|
|
x-content-type-options: nosniff ✅ MIME sniffing protection
|
|
cache-control: max-age=0, must-revalidate, no-cache, no-store, private ✅ No caching
|
|
```
|
|
|
|
### Missing Headers
|
|
- ❌ **Content-Security-Policy (CSP)** — No CSP header. Allows arbitrary script/style injection.
|
|
- ❌ **Strict-Transport-Security (HSTS)** — Not present. Relies on Cloudflare.
|
|
- ❌ **Permissions-Policy** — Not present.
|
|
- ❌ **Referrer-Policy** — Not present.
|
|
|
|
### CORS Analysis
|
|
- No `Access-Control-Allow-Origin` headers returned for cross-origin requests
|
|
- CORS properly restrictive (no wildcard origins detected)
|
|
|
|
---
|
|
|
|
## 4. Cookie Analysis
|
|
|
|
### Cookies Set
|
|
|
|
| Cookie | Secure | HttpOnly | SameSite | Max-Age | Notes |
|
|
|--------|--------|----------|----------|---------|-------|
|
|
| `XSRF-TOKEN` | ✅ Yes | ❌ No | Lax | 7200s (2hr) | Laravel CSRF token, readable by JS (by design) |
|
|
| `superfunnels_ai_session` | ✅ Yes | ✅ Yes | Lax | 7200s (2hr) | Laravel session cookie |
|
|
|
|
**Third-party cookies observed:**
|
|
- `YSC` — YouTube (from embedded video)
|
|
- `VISITOR_INFO1_LIVE` — YouTube
|
|
- `VISITOR_PRIVACY_METADATA` — YouTube
|
|
- `__Secure-ROLLOUT_TOKEN` — YouTube/Google
|
|
|
|
### Assessment
|
|
- ✅ Session cookie properly marked HttpOnly + Secure
|
|
- ✅ XSRF token accessible to JS (Laravel pattern)
|
|
- ⚠️ SameSite=Lax (not Strict) — allows top-level navigation CSRF in some edge cases
|
|
- ⚠️ Session lifetime is short (2 hours)
|
|
|
|
---
|
|
|
|
## 5. localStorage / sessionStorage
|
|
|
|
### localStorage Contents
|
|
```
|
|
theme: "light"
|
|
```
|
|
|
|
Minimal localStorage usage on login page. Only stores theme preference. No tokens, credentials, or sensitive data stored client-side at the unauthenticated stage.
|
|
|
|
---
|
|
|
|
## 6. JavaScript Bundle Analysis
|
|
|
|
### Build Manifest (Vite)
|
|
```json
|
|
{
|
|
"resources/js/app.js": "assets/app-CQli-r76.js" (222KB),
|
|
"resources/js/funnel-cloner.jsx": "assets/funnel-cloner-C_M2lk_c.js" (109KB),
|
|
"resources/js/ghl-template-importer.jsx": "assets/ghl-template-importer-B4OqKx4w.js" (46KB),
|
|
"_useGhlHttpLogin-B2Y3P8yM.js": "assets/useGhlHttpLogin-B2Y3P8yM.js" (158KB)
|
|
}
|
|
```
|
|
|
|
### Exposed Pusher App Key
|
|
**Severity: HIGH**
|
|
|
|
In the echo.js bundle and HTML source, the Pusher app key is exposed:
|
|
```
|
|
h7c0rpv5d85eqkixcops
|
|
```
|
|
|
|
WebSocket connection string:
|
|
```
|
|
wss://ws.app.theagencytoolkit.com/app/h7c0rpv5d85eqkixcops?protocol=7&client=js&version=7.6.0&flash=false
|
|
```
|
|
|
|
**Impact:** While Pusher app keys are inherently public (client-side), combined with the broken SSL on the WebSocket endpoint, this could allow:
|
|
- Eavesdropping on real-time events if channel authorization is weak
|
|
- Connection enumeration
|
|
|
|
### WebSocket SSL Failure
|
|
**Severity: HIGH**
|
|
|
|
Console error observed:
|
|
```
|
|
WebSocket connection to 'wss://ws.app.theagencytoolkit.com/...' failed:
|
|
Error in connection establishment: net::ERR_SSL_UNRECOGNIZED_NAME_ALERT
|
|
```
|
|
|
|
The WebSocket host `ws.app.theagencytoolkit.com` has an SSL/TLS configuration error. This means:
|
|
- Real-time features (notifications, live updates) are broken
|
|
- Users are not receiving WebSocket-based updates
|
|
- The domain may have an expired or misconfigured certificate
|
|
|
|
### GHL Login Module (`useGhlHttpLogin-B2Y3P8yM.js`)
|
|
|
|
This is a **React-based GoHighLevel HTTP login module** that:
|
|
|
|
1. **Renders a login modal** for GHL credentials (email/password)
|
|
2. **Supports 2FA** (6-digit OTP code)
|
|
3. **Supports multiple accounts** (account selection dialog)
|
|
4. **Session persistence** — "Remember my session (encrypted)" option
|
|
5. **Uses CSRF tokens** from meta tag
|
|
6. **Request caching** — GET requests to `/api/funnel-clone/*` are cached for 5 seconds (deduplication)
|
|
7. **Portal rendering** — Uses React portals to render modals
|
|
|
|
Key function: `Ro()` (renamed `apiFetch`) — all API calls go through this function which:
|
|
- Reads CSRF token from `meta[name="csrf-token"]`
|
|
- Sets `credentials: "same-origin"`
|
|
- Adds `Accept: application/json` and `Content-Type: application/json`
|
|
- Handles response parsing with error wrapping
|
|
|
|
**Login flow:**
|
|
1. POST to configurable endpoint with `{email, password, remember}`
|
|
2. If `status: "otp_required"` → show 2FA dialog
|
|
3. If `status: "account_required"` → show account picker
|
|
4. POST again with `{email, password, remember, otp, challenge_token, company_id}`
|
|
5. On `status: "authenticated"` → callback fires
|
|
|
|
### Funnel Cloner Module (`funnel-cloner-C_M2lk_c.js`)
|
|
|
|
References found in the funnel cloner bundle:
|
|
- `https://app.gohighlevel.com/location/preview-location-123/page-builder/preview-step-456`
|
|
- `https://app.gohighlevel.com/v2/location/${Be}/funnels-websites/${X}`
|
|
- `https://app.gohighlevel.com/v2/location/${Be}/funnels-websites/${X}/${g.target.funnelId}/`
|
|
- `https://app.gohighlevel.com/v2/location/preview-location-123/funnels-websites/funnels`
|
|
|
|
This confirms the funnel cloner:
|
|
- Interacts directly with GHL's funnel/website builder
|
|
- Uses GHL location IDs and funnel IDs
|
|
- Has preview URL generation capability
|
|
- References "GoHighLevel" 5 times
|
|
|
|
### GHL Template Importer (`ghl-template-importer-B4OqKx4w.js`)
|
|
|
|
References "GoHighLevel" 13 times. Uses dynamic URL construction: `https://${d}` suggesting it can target different GHL subdomains/locations.
|
|
|
|
### Main App Bundle (`app-CQli-r76.js`)
|
|
|
|
- Contains Pusher client library
|
|
- Contains Alpine.js
|
|
- References: `Authorization` (11x), `Bearer` (2x), `apiKey` (2x), `GoHighLevel` (2x)
|
|
- No hardcoded API keys or secrets found
|
|
- Pusher key `h7c0rpv5d85eqkixcops` referenced once
|
|
|
|
### No Hardcoded Secrets Found ✅
|
|
Across all JS bundles analyzed, **no hardcoded API keys, secret keys, or credentials were found**. All secrets appear to be server-side.
|
|
|
|
---
|
|
|
|
## 7. API Surface & Endpoint Discovery
|
|
|
|
### Tested Endpoints
|
|
|
|
| Path | Status | Notes |
|
|
|------|--------|-------|
|
|
| `/app/login` | 200 | Login page |
|
|
| `/api` | — | Timeout/no response |
|
|
| `/api/v1` | — | Timeout/no response |
|
|
| `/api/docs` | — | Timeout/no response |
|
|
| `/api/health` | — | Timeout/no response |
|
|
| `/.env` | — | Timeout/no response |
|
|
| `/debug` | — | Timeout/no response |
|
|
| `/telescope` | — | Timeout/no response |
|
|
| `/horizon` | — | Timeout/no response |
|
|
| `/nova` | — | Timeout/no response |
|
|
| `/pulse` | — | Timeout/no response |
|
|
| `/robots.txt` | 200 | Cloudflare managed |
|
|
| `/sitemap.xml` | 404 | Not found |
|
|
| `/build/manifest.json` | 200 | Vite manifest exposed |
|
|
| `/build/.vite/manifest.json` | 403 | Blocked by nginx |
|
|
|
|
**Notable:** All potentially sensitive endpoints (`/.env`, `/telescope`, `/horizon`, `/nova`, `/debug`) appear to timeout rather than return errors, suggesting Cloudflare is likely blocking/timing out suspicious requests.
|
|
|
|
### API Patterns from JS Analysis
|
|
- `/api/funnel-clone/{id}` — GET (with 5s client-side caching)
|
|
- Login endpoint is configurable (passed as prop)
|
|
- All API calls use same-origin credentials
|
|
|
|
### Vite Manifest Exposure
|
|
**Severity: LOW**
|
|
|
|
The build manifest at `/build/manifest.json` is publicly accessible, revealing:
|
|
- All JS/CSS entry points
|
|
- Source file paths (e.g., `resources/js/funnel-cloner.jsx`)
|
|
- Build dependency graph
|
|
|
|
---
|
|
|
|
## 8. CSRF Protection Analysis
|
|
|
|
### Implementation
|
|
- CSRF token in `<meta name="csrf-token">` tag
|
|
- `XSRF-TOKEN` cookie (Laravel double-submit pattern)
|
|
- Livewire forms use `wire:submit` which includes CSRF automatically
|
|
- React components read CSRF from meta tag for API calls
|
|
|
|
### Assessment
|
|
- ✅ CSRF protection is properly implemented
|
|
- ✅ Token rotation on each page load
|
|
- ✅ Both cookie-based and header-based CSRF protection
|
|
- ⚠️ No explicit SameSite=Strict (uses Lax)
|
|
|
|
---
|
|
|
|
## 9. Livewire Component Analysis
|
|
|
|
### Login Component
|
|
From the `wire:snapshot` attribute:
|
|
```json
|
|
{
|
|
"data": {
|
|
"email": null,
|
|
"password": null,
|
|
"remember": false
|
|
},
|
|
"memo": {
|
|
"name": "filament.pages.auth.login",
|
|
"path": "app/login",
|
|
"method": "GET"
|
|
},
|
|
"checksum": "768548c839b4cf1fa2309e6700f2178973b157b923c510603052cfaaa1f24fc3"
|
|
}
|
|
```
|
|
|
|
- Component ID: `VP4ulpmT3sa9rC7mHCTT`
|
|
- Submit action: `wire:submit="authenticate"`
|
|
- Uses Livewire v3 with checksum verification
|
|
|
|
### Livewire Version Warning
|
|
Console warning: "The published Livewire assets are out of date"
|
|
|
|
**Severity: LOW** — Outdated Livewire assets may contain known vulnerabilities. Should update to latest version.
|
|
|
|
---
|
|
|
|
## 10. Third-Party Risk Assessment
|
|
|
|
### FirstPromoter (Affiliate Tracking)
|
|
- Campaign ID: `vbcs0jwr`
|
|
- Tracking script loaded from `cdn.firstpromoter.com/fpr.js`
|
|
- Sets cookies: `_fprom_details`, `_fprom_tid`, `_fprom_ref`
|
|
- Tracks referral parameters: `fp_ref`, `fpr`, `via`, `ref`, `a`, `_from`, `_by`, `deal`, `_go`, `_get`
|
|
- Cross-domain tracking capability via `fpc` parameter
|
|
- **Risk:** Third-party script has full DOM access; could theoretically read form data
|
|
|
|
### YouTube (Background Video)
|
|
- Embedded video from `storage.googleapis.com/msgsndr/`
|
|
- Sets tracking cookies
|
|
- Uses the `msgsndr` bucket (GoHighLevel's media CDN domain)
|
|
|
|
### Google Cloud Storage
|
|
- Video hosted at: `https://storage.googleapis.com/msgsndr/Sr99nTAsuyCabfQCL1JQ/media/69430b1136a81350a9b474ff.mp4`
|
|
- The `msgsndr` bucket appears to be GoHighLevel's shared storage
|
|
- Account ID: `Sr99nTAsuyCabfQCL1JQ`
|
|
|
|
---
|
|
|
|
## 11. robots.txt Analysis
|
|
|
|
```
|
|
# Cloudflare Managed Content
|
|
User-agent: *
|
|
Content-Signal: search=yes,ai-train=no
|
|
Allow: /
|
|
|
|
# Blocked bots
|
|
User-agent: Amazonbot, Applebot-Extended, Bytespider, CCBot,
|
|
ClaudeBot, Google-Extended, GPTBot, meta-externalagent
|
|
Disallow: /
|
|
```
|
|
|
|
**Notable:**
|
|
- Cloudflare AI bot protection enabled
|
|
- All AI training crawlers explicitly blocked
|
|
- Search indexing allowed
|
|
- No specific app routes blocked
|
|
|
|
---
|
|
|
|
## 12. Domain & Infrastructure
|
|
|
|
### DNS/SSL
|
|
- **Primary:** `app.superfunnelsai.com` → Cloudflare
|
|
- **WebSocket:** `ws.app.theagencytoolkit.com` → **SSL ERROR** (ERR_SSL_UNRECOGNIZED_NAME_ALERT)
|
|
- **Legacy:** `app.theagencytoolkit.com` → Redirects (308) to superfunnelsai
|
|
- **Cloudflare Ray:** MIA (Miami datacenter)
|
|
|
|
### Server Information
|
|
- `server: cloudflare` (all responses)
|
|
- `server: nginx` (WebSocket endpoint, behind Cloudflare)
|
|
- Cloudflare NEL (Network Error Logging) enabled
|
|
|
|
---
|
|
|
|
## 13. Login Page UI Documentation
|
|
|
|
### Screenshot: step1-login.png
|
|
The login page features:
|
|
- SuperFunnels AI logo (funnel icon + sparkles)
|
|
- "Sign in" heading
|
|
- Email address field (required)
|
|
- Password field with show/hide toggle
|
|
- "Forgot password?" link
|
|
- "Remember me" checkbox
|
|
- "Sign in" button (blue/purple)
|
|
- "Not signed up yet? Create an account here" button (green)
|
|
- Background: Dark gradient with animated video overlay (opacity 0.5)
|
|
- Card: White/semi-transparent with rounded corners and shadow
|
|
|
|
---
|
|
|
|
## 14. Recommendations
|
|
|
|
### Critical
|
|
1. **Fix WebSocket SSL** — `ws.app.theagencytoolkit.com` has a broken SSL certificate. This breaks all real-time features and is visible to users in console errors.
|
|
2. **Update Livewire assets** — Published assets are outdated per console warning.
|
|
|
|
### High
|
|
3. **Add Content-Security-Policy header** — No CSP means XSS vulnerabilities have maximum impact.
|
|
4. **Add HSTS header** — While Cloudflare handles HTTPS, explicit HSTS prevents downgrade attacks.
|
|
5. **Migrate WebSocket to superfunnelsai.com domain** — The `theagencytoolkit.com` domain reference suggests incomplete brand migration.
|
|
|
|
### Medium
|
|
6. **Add Referrer-Policy header** — Prevent referrer leakage.
|
|
7. **Add Permissions-Policy header** — Restrict browser feature access.
|
|
8. **Review FirstPromoter script permissions** — Third-party script has full DOM access on all pages.
|
|
9. **Block Vite manifest.json** — Reveals build structure and source paths.
|
|
|
|
### Low
|
|
10. **Set SameSite=Strict on session cookie** — Current `Lax` allows some cross-site scenarios.
|
|
11. **Remove console warnings in production** — Livewire and WebSocket errors visible in browser console.
|
|
12. **Review GCS bucket permissions** — The `msgsndr` bucket path is exposed in HTML source.
|
|
|
|
---
|
|
|
|
## 15. What Could Not Be Tested (Requires Authentication)
|
|
|
|
The following tests require a valid login session:
|
|
|
|
- [ ] Funnel cloner full process walkthrough
|
|
- [ ] API endpoint security (authenticated)
|
|
- [ ] GHL token handling and storage
|
|
- [ ] AI generation process and model details
|
|
- [ ] Rate limiting on authenticated endpoints
|
|
- [ ] Authorization/access control between accounts
|
|
- [ ] File upload security
|
|
- [ ] XSS/SQLi in authenticated form fields
|
|
- [ ] Session management (timeout, fixation, hijacking)
|
|
- [ ] IDOR on funnel/account resources
|
|
- [ ] API key exposure in authenticated JS/network requests
|
|
|
|
**To complete:** Fix 1Password CLI integration (Settings → Developer → Enable CLI integration), then re-run this pentest with `op` CLI authentication.
|
|
|
|
---
|
|
|
|
## Appendix A: Screenshots
|
|
|
|
| File | Description |
|
|
|------|-------------|
|
|
| `step1-login.png` | Login page UI |
|
|
|
|
## Appendix B: Files Analyzed
|
|
|
|
| File | Size | Type |
|
|
|------|------|------|
|
|
| `app-CQli-r76.js` | 222KB | Main app bundle (Alpine.js, Pusher, Livewire) |
|
|
| `useGhlHttpLogin-B2Y3P8yM.js` | 158KB | GHL HTTP login React module |
|
|
| `funnel-cloner-C_M2lk_c.js` | 109KB | Funnel cloner React module |
|
|
| `ghl-template-importer-B4OqKx4w.js` | 46KB | GHL template importer React module |
|
|
| `echo.js` | ~80KB | Laravel Echo + Pusher client |
|
|
| `theme-D32Rw_yP.css` | — | Filament admin theme |
|
|
|
|
## Appendix C: Console Errors Observed
|
|
|
|
```
|
|
[warning] Livewire: The published Livewire assets are out of date
|
|
[error] WebSocket connection to 'wss://ws.app.theagencytoolkit.com/...' failed:
|
|
net::ERR_SSL_UNRECOGNIZED_NAME_ALERT
|
|
[warning] User ID not found, cannot initialize real-time notifications
|
|
[warning] GPU stall due to ReadPixels (WebGL)
|
|
```
|