+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.li/Forum-Hacking-Tools)
+--- Thread: XSS ChEF - Chrome Extension Exploitation Framework (/Thread-XSS-ChEF-Chrome-Extension-Exploitation-Framework)
XSS ChEF - Chrome Extension Exploitation Framework - ZanGetsu - 09-18-2017
![[Image: xss-chef.png]](https://github.com/koto/xsschef/raw/master/bootstrap/img/xss-chef.png)
This is a Chrome Extension Exploitation Framework - think BeEF for Chrome extensions. Whenever you encounter a XSS vulnerability in Chrome extension, ChEF will ease the exploitation.
What can you actually do (when having appropriate permissions)?
- Monitor open tabs of victims
- Execute JS on every tab (global XSS)
- Extract HTML, read/write cookies (also httpOnly), localStorage
- Get and manipulate browser history
- Stay persistent until whole browser is closed (or even futher if you can persist in extensions' localStorage)
- Make screenshot of victims window
- Further exploit e.g. via attaching BeEF hooks, keyloggers etc.
- Explore filesystem through file:// protocol
- Bypass Chrome extensions content script sandbox to interact directly with page JS
Demo: