Options
24 |25 | 28 | 31 | 34 | 37 |
38 | Toolbox 39 | 40 |
41 |42 | 43 |
New container tab
44 |45 |
46 |
47 | 
PwnFox
14 |
15 |
18 | Settings
19 |
20 | 25 | 28 | 31 | 34 | 37 |
42 | 43 |
45 |
PwnFox
2 |
3 | PwnFox is a Firefox/Burp extension that provide usefull tools for your security audit.
4 |
5 | If you are a chrome user you can check https://github.com/nccgroup/autochrome.
6 |
7 | - [PwnFox](#img-srcfirefoxiconsiconsvg-width30-pwnfox)
8 | - [Features](#features)
9 | - [Single click BurpProxy](#single-click-burpproxy)
10 | - [Containers Profiles](#containers-profiles)
11 | - [PostMessage Logger](#postmessage-logger)
12 | - [Toolbox](#toolbox)
13 | - [Security header remover](#security-header-remover)
14 | - [Installation](#installation)
15 | - [Build](#build)
16 | - [All](#all)
17 | - [Firefox](#firefox)
18 | - [Burp](#burp)
19 | - [Changelog](#changelog)
20 |
21 |
22 | ## Features
23 |
24 | 
25 |
26 | ### Single click BurpProxy
27 |
28 | Connect to Burp with a simple click, this will probably remove the need for other addons like foxyProxy. However if you need the extra features provided by foxyProxy you can leave this unchecked.
29 |
30 | ### Containers Profiles
31 |
32 | PwnFox give you fast access to the Firefox containers. This allow you to have multiple identities in the same browser.
33 | When PwnFox and the `Add container header` option are enabled, PwnFox will automatically add a `X-PwnFox-Color` header to hightlight the query in Burp.
34 |
35 | PwnFoxBurp will automatically highlight and strip the header, but you can also specify your own behavior with addons like logger++.
36 |
37 | 
38 | 
39 |
40 |
41 |
42 | ### PostMessage Logger
43 |
44 | PwnFox add a new message tab in you devtool. This allow you to quickly visualize all postMessage between frames.
45 |
46 | 
47 |
48 | You can also provide your own function to parse/filter the messages.
49 | You get access to 3 arguments:
50 | * data -> the message data
51 | * origin -> the window object representing the origin
52 | * destion -> the window object representing the destination
53 |
54 | You can return a string or a JSON serializable object.
55 |
56 | 
57 |
58 |
59 | ### Toolbox
60 |
61 | Inject you own javascript code on page load. The code will be loaded as soon as possible. This can used to add dangerous behavior detection, or just to add extra function to your js console.
62 |
63 | **Be carefull, the injected toolbox will run in the window context. Do not inject secret in untrusted domain.**
64 |
65 |
66 | 
67 |
68 | I will publish some of my toolbox soon (ENOTIME)
69 |
70 |
71 | ### Security header remover
72 |
73 | Sometime it's easier to work with security header disabled. You can now do it with a single button press. Don't forget to reenable them before testing your final payload.
74 |
75 | Headers stripped:
76 | * Content-Security-Policy
77 | * X-XSS-Protection
78 | * X-Frame-Options
79 | * X-Content-Type-Options
80 |
81 | ## Installation
82 |
83 |
84 | You can find the latest build here:
85 | * [https://github.com/B-i-t-K/PwnFox/releases](https://github.com/B-i-t-K/PwnFox/releases)
86 |
87 | ### Firefox
88 | - visit `about:addons` and choose install from file, then select `PwnFox-$version.xpi`
89 | - or install from
90 | [https://addons.mozilla.org/en-US/firefox/addon/pwnfox/](https://addons.mozilla.org/en-US/firefox/addon/pwnfox/)
91 |
92 | ### Burp
93 | - Go to extender and add `PwnFox-Burp.jar` as a java extension.
94 |
95 | ## Build
96 |
97 | ### Firefox
98 |
99 | ```shell
100 | cd firefox
101 | web-ext build
102 | # the zip file is available in /firefox/web-ext-artifacts/pwnfox-${version}.zip
103 | # Optional. If you want to sign you own build
104 | web-ext sign --api-key="$KEY" --api-secret="$SECRET"
105 | # the xpi file is available in /firefox/web-ext-artifacts/pwnfox-${version}.xpi
106 |
107 | ```
108 | ### Burp
109 |
110 | Open and compile with Intellij IDEA
111 |
112 | ## Changelog
113 |
114 | * v1.0.3
115 | * Fix missing highlight with burp v2021.4.2
116 | * v1.0.2
117 | * First public release
118 |
--------------------------------------------------------------------------------
/firefox/src/devtools/panel/panel.css:
--------------------------------------------------------------------------------
1 | :root {
2 | --background-color: #232327;
3 | --text-color: #C6C6CA;
4 | }
5 |
6 | html,
7 | body {
8 | padding: 0;
9 | margin: 0;
10 | color: var(--text-color);
11 | }
12 |
13 | * {
14 | box-sizing: border-box;
15 | }
16 |
17 |
18 | main {
19 | background-color: #0C0C0D;
20 | font-family: monospace;
21 | display: grid;
22 | grid-template-columns: 1fr;
23 | grid-template-rows: auto 1fr;
24 | grid-template-areas: "toolbar""list";
25 | align-items: start;
26 | border-bottom: 2px solid black;
27 | height: 100vh;
28 | }
29 |
30 | main.dual {
31 | grid-template-columns: auto 500px;
32 | grid-template-areas: "toolbar filter""list filter";
33 | }
34 |
35 | #message-toolbar {
36 | grid-area: toolbar;
37 | display: flex;
38 | column-gap: 5px;
39 | background: #2a2a2e;
40 | padding: 5px;
41 | width: 100%;
42 | }
43 |
44 | #message-toolbar svg {
45 | padding: 4px;
46 | }
47 |
48 | #message-toolbar button,
49 | #message-toolbar svg {
50 |
51 | border: none;
52 | border-radius: 2px;
53 | white-space: nowrap;
54 | user-select: none;
55 | background-color: rgba(249, 249, 250, 0.2);
56 | color: rgb(215, 215, 219);
57 | text-align: center;
58 | }
59 |
60 | #message-toolbar button:hover,
61 | #message-toolbar svg:hover {
62 | background-color: rgba(249, 249, 250, 0.3);
63 |
64 | }
65 |
66 | #message-list {
67 | display: contents;
68 | }
69 |
70 |
71 | #message-table {
72 | grid-area: list;
73 | overflow-y: auto;
74 | overflow-x: hidden;
75 | scrollbar-width: thin;
76 | height: 100%;
77 | display: flex;
78 | flex-direction: column;
79 | vertical-align: middle;
80 | justify-content: start;
81 | counter-reset: message-id;
82 | }
83 |
84 | #message-table>.row {
85 | top: 0;
86 | position: sticky;
87 | z-index: 10;
88 | background: #2a2a2e;
89 | }
90 |
91 | .spacer {
92 | flex-grow: 1;
93 | }
94 |
95 | .row {
96 | display: grid;
97 | grid-template-columns: 40px 1fr 1fr 4fr 75px;
98 | line-height: 14px;
99 | font-size: 11px;
100 | border-bottom: 1px solid #4E4E51;
101 | background: var(--background-color);
102 | background: #2a2a2e;
103 | }
104 |
105 | .row:hover {
106 | background: #3a3a3e
107 | }
108 |
109 | .row span::after {
110 | display: block;
111 | content: "";
112 | top: -1px;
113 | bottom: -1px;
114 | right: 0px;
115 | left: -1px;
116 | position: absolute;
117 | border-right: 1px solid #4E4E51;
118 | }
119 |
120 | #message-list .row span:first-child:before {
121 | counter-increment: message-id;
122 | content: counter(message-id, decimal-leading-zero)
123 | }
124 |
125 | #message-list .row:hover {
126 | border-bottom: 1px solid #4E4E51;
127 | }
128 |
129 | #message-table>.row {
130 | border-top: 1px solid #4E4E51;
131 | font-weight: bold;
132 | }
133 |
134 |
135 | .row span {
136 | position: relative;
137 | white-space: nowrap;
138 | overflow-x: hidden;
139 |
140 | text-overflow: ellipsis;
141 | padding: 2px 4px;
142 | }
143 |
144 | #message-filter {
145 | display: none;
146 | }
147 |
148 | .dual #message-filter {
149 | grid-area: filter;
150 | display: grid;
151 | grid-template-rows: 30px auto;
152 | height: 100%;
153 | }
154 |
155 | #message-filter h2 {
156 | text-align: center;
157 | margin: 0;
158 | line-height: 30px;
159 | font-weight: lighter;
160 | }
161 |
162 | textarea {
163 | padding: 5px;
164 | height: 100%;
165 | display: block;
166 | resize: none;
167 | }
168 |
169 | .message-details-content {
170 | padding: 10px;
171 | display: grid;
172 | grid-template-columns: 90px 1fr;
173 | row-gap: 10px;
174 | column-gap: 10px;
175 | background: #0c0c0d;
176 | }
177 |
178 | .message-details-content span:nth-child(even) {
179 | white-space: pre;
180 | }
181 |
182 | summary {
183 | cursor: pointer;
184 | outline: 0;
185 | }
186 |
187 | .message-details-content span:nth-child(odd) {
188 | border-right: 1px solid #b1b1b3;
189 | }
--------------------------------------------------------------------------------
/firefox/src/settings/index.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
73 |
74 |
75 |
76 |
77 |
78 |
79 |
--------------------------------------------------------------------------------
/firefox/src/fileSelection.js:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | async function newFileSelection(config, storeName, selector, defaultName) {
5 | const el = document.querySelector(selector)
6 | const select = el.querySelector("select")
7 | const files = await config.get(storeName);
8 |
9 | const newBtn = el.querySelector(".file-list-new")
10 | const saveBtn = el.querySelector(".file-list-save")
11 | const deleteBtn = el.querySelector(".file-list-delete")
12 | const editBtn = el.querySelector(".file-list-edit")
13 | const textarea = el.querySelector("textarea")
14 | /* Utils */
15 |
16 | function createOption(filename) {
17 | const option = document.createElement("option")
18 | option.innerText = filename
19 | option.value = filename
20 | return option
21 | }
22 |
23 | function preventDuplicate(filenames, newName) {
24 | let idx = 2;
25 | let testName = newName
26 | while (testName in filenames) {
27 | testName = `${newName} (${idx})`
28 | idx += 1;
29 | }
30 | return testName
31 | }
32 | function addShadow() {
33 | if (textarea.value !== files[select.value]) {
34 | textarea.classList.add("changed")
35 | } else {
36 | textarea.classList.remove("changed")
37 | }
38 | }
39 | /* File operations */
40 |
41 | function addFile(filename, content) {
42 | select.appendChild(createOption(filename))
43 | saveFile(filename, content)
44 | textarea.disabled = select.children.length === 0
45 | select.value = filename
46 | showFile(filename)
47 | }
48 |
49 | function saveFile(filename, content) {
50 | files[filename] = content
51 | config.set(storeName, files)
52 | }
53 |
54 | function removeFile(filename) {
55 | const toRemove = Array.from(select.children).find(c => c.value === filename)
56 | select.removeChild(toRemove)
57 | delete files[filename]
58 | config.set(storeName, files)
59 | textarea.disabled = select.children.length === 0
60 | }
61 |
62 | function showFile(filename) {
63 | textarea.value = files[filename] || ""
64 | }
65 |
66 |
67 | /* Handle file Selection */
68 | for (const filename of Object.keys(files)) {
69 | select.appendChild(createOption(filename))
70 | }
71 |
72 |
73 | /* Handle events */
74 | select.addEventListener("change", ev => {
75 | showFile(select.value)
76 | })
77 |
78 | deleteBtn.addEventListener("click", ev => {
79 | ev.preventDefault()
80 | removeFile(select.value)
81 | showFile(select.value)
82 | })
83 |
84 | saveBtn.addEventListener("click", ev => {
85 | ev.preventDefault()
86 | const filename = select.value
87 | const content = textarea.value
88 | saveFile(filename, content)
89 | addShadow()
90 | })
91 |
92 | newBtn.addEventListener("click", ev => {
93 | ev.preventDefault()
94 | const response = window.prompt("name ?", defaultName).trim()
95 | if (!response) return
96 | const filename = preventDuplicate(files, response)
97 | addFile(filename, "")
98 | })
99 |
100 | editBtn.addEventListener("click", ev => {
101 | ev.preventDefault()
102 | const oldName = select.value
103 | const response = window.prompt("rename to ?", oldName).trim()
104 | if (!response || response === oldName) return
105 | const newName = preventDuplicate(files, response)
106 | const oldContent = files[oldName]
107 | removeFile(oldName)
108 | addFile(newName, oldContent)
109 | })
110 |
111 | textarea.addEventListener("keydown", ev => {
112 |
113 | /* ctrl+s -> save */
114 | if (ev.ctrlKey && ev.key === "s") {
115 | ev.preventDefault()
116 | const filename = select.value
117 | const content = textarea.value
118 | saveFile(filename, content)
119 | }
120 |
121 | addShadow()
122 | })
123 |
124 | textarea.addEventListener("keyup", addShadow)
125 |
126 |
127 | showFile(select.value)
128 | textarea.disabled = select.children.length === 0
129 | }
130 |
131 |
--------------------------------------------------------------------------------
/firefox/src/devtools/panel/panel.js:
--------------------------------------------------------------------------------
1 |
2 | /* Create a filter function and store the compiled version */
3 | const func_cache = {}
4 | async function getFilterFunction(config) {
5 | const funcName = await config.get("activeMessageFunc")
6 | const funcSrc = (await config.get("savedMessageFunc"))[funcName] || "return data"
7 | if (!(funcSrc in func_cache)) {
8 | func_cache[funcSrc] = new Function("data", "origin", "destination", funcSrc)
9 | }
10 | return func_cache[funcSrc]
11 | }
12 |
13 | function createCell(txt) {
14 | const cell = document.createElement("span")
15 | cell.innerText = txt
16 | return cell
17 | }
18 |
19 | function createDetailsContent(origin, destination, message) {
20 | const content = document.createElement("div")
21 | content.classList.add("message-details-content")
22 |
23 |
24 | const oriTitle = createCell("Origin")
25 | const ori = document.createElement("span")
26 | ori.innerText = origin
27 |
28 |
29 | const destTitle = createCell("Destination")
30 | const dest = document.createElement("span")
31 | dest.innerText = destination
32 |
33 | const msgTitle = createCell("Message")
34 | const msg = document.createElement("span")
35 | msg.innerText = typeof message === "string" ? message : JSON.stringify(message, null, 2)
36 |
37 |
38 | content.appendChild(oriTitle)
39 | content.appendChild(ori)
40 | content.appendChild(destTitle)
41 | content.appendChild(dest)
42 | content.appendChild(msgTitle)
43 | content.appendChild(msg)
44 | return content
45 | }
46 |
47 | function stripProtocol(s) {
48 | if (s.startsWith('http://')) {
49 | return s.substr(7)
50 | }
51 | if (s.startsWith('https://')) {
52 | return s.substr(8)
53 | }
54 | return s
55 | }
56 |
57 | function createRow(origin, dest, msg, time) {
58 | const details = document.createElement("details")
59 | const summary = document.createElement("summary")
60 |
61 | details.open = false
62 | summary.classList.add("row")
63 | summary.appendChild(createCell(""))
64 | summary.appendChild(createCell(stripProtocol(origin)))
65 | summary.appendChild(createCell(stripProtocol(dest)))
66 | summary.appendChild(createCell(typeof msg === "string" ? msg : JSON.stringify(msg)))
67 | summary.appendChild(createCell(time))
68 | details.appendChild(summary)
69 | details.appendChild(createDetailsContent(origin, dest, msg))
70 | return details
71 | }
72 |
73 | function addRow(origin, dest, msg, time) {
74 | const container = document.querySelector("#message-list")
75 | container.appendChild(createRow(origin, dest, msg, time))
76 | }
77 |
78 | function createMessageHandler(config) {
79 | return async function handleMessage(message) {
80 | const date = new Date()
81 | const h = date.getHours().toString().padStart(2, "0")
82 | const m = date.getMinutes().toString().padStart(2, "0")
83 | const s = date.getSeconds().toString().padStart(2, "0")
84 | const time = `${h}:${m}:${s}`
85 | const filterFunction = await getFilterFunction(config)
86 | try {
87 | const data = filterFunction(message.data, message.origin, message.destination)
88 | if (data === null) return
89 | addRow(message.origin, message.destination, data, time)
90 | } catch (e) {
91 | addRow(message.origin, message.destination, `ERROR: ${e.toString()}`, time)
92 | }
93 |
94 | }
95 | }
96 |
97 |
98 | async function main() {
99 | const $ = sel => document.querySelector(sel)
100 | const $$ = sel => Array.from(document.querySelectorAll(sel))
101 |
102 | window.handleMessage = createMessageHandler(config)
103 |
104 | /* Top left buttons */
105 | $("#btn-clear").addEventListener("click", () => {
106 | $("#message-list").innerHTML = ""
107 | })
108 | $("#btn-shrink").addEventListener("click", () => {
109 | Array.from($$("details")).forEach(el => el.open = false)
110 | })
111 | $("#btn-expand").addEventListener("click", () => {
112 | Array.from($$("details")).forEach(el => el.open = true)
113 | })
114 |
115 |
116 | /* toggle panel */
117 | if (await config.get("devToolDual")) {
118 | $("main").classList.add("dual")
119 | }
120 | $("#toggleDual").addEventListener("click", () => {
121 | $("main").classList.toggle("dual")
122 | config.set("devToolDual", $("main").classList.contains("dual"))
123 | })
124 |
125 |
126 | /* Right panel */
127 | newFileSelection(config, "savedMessageFunc", "#savedMessageFunc", "filter")
128 |
129 | const select = $("#savedMessageFunc select")
130 | const activeMessageFunc = await config.get("activeMessageFunc")
131 |
132 | Array.from(select.children).find(c => c.selected = c.value === activeMessageFunc)
133 | select.addEventListener("change", () => {
134 | config.set("activeMessageFunc", select.value)
135 | })
136 |
137 | const textarea = $("#savedMessageFunc textarea")
138 | textarea.value = (await config.get("savedMessageFunc"))[activeMessageFunc] || ""
139 | }
140 |
141 | window.addEventListener("DOMContentLoaded", main)
--------------------------------------------------------------------------------
/firefox/src/devtools/panel/panel.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
16 |
17 |
18 |
19 |
20 |
27 |
28 |
29 |
40 |
30 | Id
31 | Origin
32 | Destination
33 | Message
34 | Time
35 |
36 |
37 |
38 |
39 |
41 |
87 | Filter function
42 |
43 |
86 |
44 |
46 |
47 |
54 |
55 |
62 |
82 |
83 |
84 |
85 |