yeswehack / pwnfox Goto Github PK
View Code? Open in Web Editor NEWPwnFox is a Firefox/Burp extension that provide usefull tools for your security audit.
PwnFox is a Firefox/Burp extension that provide usefull tools for your security audit.
I noticed PwnFox extension always update the ย Content-Length
header in BurpSuite Pro v2020.9.2 (not tested on other versions).
Steps to reproduce:
Content-Length
header value to high value, for example 9999999:POST / HTTP/1.1
Host: www.google.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 9999999
12345
Update Content-Length
option in the Repeater top menu.405 Method Not Allowed
Expected result:
www.google.com should reply with 413 Request Entity Too Large
because the Content-Length value is too high (it should timeout for lower values). You can verify this behavior by enabling or disabling the PwnFox extension between requests.
Also you can see in the Logger++
extension that the Content-Length
header value has been updated when the extension is enable.
Is this "auto-update" feature intended / necessary ? This also works works out of repeater (like intruder for example). An automatic update could prevent exploitation of vulnerabilities such as request smuggling.
Would it be possible to turn off proxy settings for containers that are not created by PwnFox ?
I use containers for other purposes (with Multi-Account Container) and would like to bypass proxy settings applied by PwnFox
Hi @B-i-t-K , I get the following error when trying to load the extension:
Read in the following post that it could be due to the way it was packaged but after unzipping it, it seems to have the proper structure.
Thanks for the help
I am having a problem with newer versions of firefox. While the add-on is properly installed and visible on the Add-ons and themes page, no status icon is displayed in the toolbar. In consequence, I cannot activate it or open a new container.
I have observed this behaviour on Firefox 115(ESR) on Kali Linux and Firefox 117 on Windows 10.
No error messages are printed in the console, not even when inspecting the add-on vie about:debugging
.
Hello, thanks for this great addon. The "Enabled" checkbox doesn't work properly. When it is checked and I uncheck it, the burp proxy gets deactivated, just as expected. However, when checking "Enabled" again, the burp proxy doesn't get activated again. To do this, I need to uncheck and check again the "Use burp proxy" checkbox.
Also, when "Enabled" is unchecked and I check "Use burp proxy", the burp proxy gets activated, even though "Enabled" is unchecked.
There seems to be problems with the validation of the checkboxes.
Loving the extension, tho sometimes the colors are a bit 'grating' on the eyes, would love to put some softer or customer colors in that are easier on the eyes.
Thank you for designing this extension for us!
Hello,
I'm using the latest version of Burpsuite v2022.12.1-17705 and when I load the PwnFox.jar 1.0.3 on it, when I use colorized tabs, it is not able to color the related HTTP requests in Burpsuite.
Can you fix it please?
Thank you for this extension. It is awesome.
Can you add a feature where we can rename the profile name as we like?
e.g. While testing with multi-accounts if we can rename the profiles with the username like admin-user, not-admin-user, etc It will help in testing.
Will love to know your thoughts on this?
Thank you.
hey i'm using this coloring the tab functionality ,but i don't see any color in burp proxy i reinstall/reconf everything in both win64/linux seems not working any more can you confirm is this issue only on my side?
Hi,
I come across a weird issue in the BurpSuite when the PwnFox extension is loaded, The Update Content-Length feature stops working. After disabling the feature, Content-Length stills gets updated when the requests are sent via the repeater. This can be checked via the logger tab.
I've spoken to PortSwigger Support, they tested the PwnFox and made the suggestion to switch using IProxyListener instead of IHttpListener.
Based on the tests they have done with PwnFox and BurpSuite, the behavior was fixed after switching to IProxyListener.
Hope this helps.
Hey, I'm running Firefox 108.0.2 (64-bit) on Arch, and it refuses to install the latest version of the addon (1.0.3).
The error message mentions that the add-on is corrupt.
Toolbox is injected just a bit late. This means inline code in the website will execute before the toolbox has a chance to hook sinks. Inline code is common among ad networks, where difficult to find XSS is also common.
You can fix this if you move this feature to the background script and use browser.contentScripts.register
.
I loaded the a page with the following content:
<!DOCTYPE html>
<script>
alert("Page alerts");
</script>
I then used a toolbox to switch alert for prompt
alert=prompt;alert("thisIsPrompt");
Visiting the page caused an alert
because the inline script finished executing before the toolbox was loaded. You can see the prompt
that is fired by the toolbox is under the alert box.
So if you were attempting to proxy/reflect or hook alert
as an interesting sink, you would of missed at least one execution.
I did not look to hard at your code, but surely your toolbox scripts are stored in some browser API storage system. All calls to that system are async. Additionally, content scripts don't have access to those API's so you query them through the background script with another async message. While those asyncs are waiting, the loaded page is executing code.
browser.contentScripts.register lets you register a new content script from the background script. This can be done with a string or file. Using both you can easily inject the toolbox into the page before the page can execute any code. There is still an async storage lookup, but it happens only once in the background script, then the content script gets registered like a static file. No ansycs happen during page load and the toolbox gets to execute before inline scripts.
Be aware, this API is Firefox only. So it can't be ported to Chrome if you chose to do that in the future.
Also of note, there is a matches
parameter that the API selects so you can easily isolate what websites you want to send the toolbox to.
I know the fix works because I use it in my own web extension. You can see the relevant code here:
https://github.com/swoops/eval_villain/blob/master/src/js/background.js#L331. The code
is a user config that is pulled from storage and the file
shoves it into the page.
Using the same code from the "example problem" above, Eval Villain pulls the user config from storage that says to hook alert, registers the content script, then when the page loads Eval Villain hooks alert before the page executes any inline scripts:
Size of code does not matter, JS is single threaded. So as long as there is no async, the page never gets a chance to steal the thread and do something.
You are welcome to use any of my code. I would of even sent you a pull but I think your code is to pretty to corrupt with my terrible JS.
Great tool, I look forward to using it.
Hi. The Pwnfox's Toolbox (tried 1.0.4 and 1.0.3 versions) does not work on new installations of Firefox (Using Firefox 107.0 (64-bit) on Ubuntu).
It still works on my other profile (same installation), but does not on new installations or profiles. I am attaching an error from browser's console (not from F12, but from CTRL+SHIFT+J).
Steps to reproduce:
console.log('asd')
);Hello Team,
I have updated my burp to the latest version i.e 2021.5.1 and I am on firefox 88.0. When I create a new container I don't see the color differentiation.
Can you please help on this
Can you guys add an options where users can set their own colors for tabs and also in burp, something like using lighter colors, current colors are really dark and when using it in burp.. eyes may start to suffer. Needs to add mild colors or users can edit the colors.
Thanks
We added support for PwnFox in Caido, see the passive workflows of EvenBetter.
Otherwise copy the workflow:
{
"description": ":D ",
"edition": 2,
"graph": {
"edges": [
{
"source": {
"exec_alias": "exec",
"node_id": 0
},
"target": {
"exec_alias": "exec",
"node_id": 2
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 2
},
"target": {
"exec_alias": "exec",
"node_id": 3
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 3
},
"target": {
"exec_alias": "exec",
"node_id": 4
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 4
},
"target": {
"exec_alias": "exec",
"node_id": 5
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 5
},
"target": {
"exec_alias": "exec",
"node_id": 6
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 7
},
"target": {
"exec_alias": "exec",
"node_id": 8
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 8
},
"target": {
"exec_alias": "exec",
"node_id": 9
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 6
},
"target": {
"exec_alias": "exec",
"node_id": 7
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 9
},
"target": {
"exec_alias": "exec",
"node_id": 10
}
},
{
"source": {
"exec_alias": "false",
"node_id": 10
},
"target": {
"exec_alias": "exec",
"node_id": 11
}
},
{
"source": {
"exec_alias": "false",
"node_id": 15
},
"target": {
"exec_alias": "exec",
"node_id": 13
}
},
{
"source": {
"exec_alias": "false",
"node_id": 13
},
"target": {
"exec_alias": "exec",
"node_id": 14
}
},
{
"source": {
"exec_alias": "true",
"node_id": 10
},
"target": {
"exec_alias": "exec",
"node_id": 18
}
},
{
"source": {
"exec_alias": "false",
"node_id": 11
},
"target": {
"exec_alias": "exec",
"node_id": 15
}
},
{
"source": {
"exec_alias": "true",
"node_id": 15
},
"target": {
"exec_alias": "exec",
"node_id": 20
}
},
{
"source": {
"exec_alias": "true",
"node_id": 13
},
"target": {
"exec_alias": "exec",
"node_id": 21
}
},
{
"source": {
"exec_alias": "true",
"node_id": 14
},
"target": {
"exec_alias": "exec",
"node_id": 22
}
},
{
"source": {
"exec_alias": "true",
"node_id": 16
},
"target": {
"exec_alias": "exec",
"node_id": 23
}
},
{
"source": {
"exec_alias": "false",
"node_id": 14
},
"target": {
"exec_alias": "exec",
"node_id": 16
}
},
{
"source": {
"exec_alias": "false",
"node_id": 16
},
"target": {
"exec_alias": "exec",
"node_id": 17
}
},
{
"source": {
"exec_alias": "true",
"node_id": 11
},
"target": {
"exec_alias": "exec",
"node_id": 19
}
},
{
"source": {
"exec_alias": "true",
"node_id": 17
},
"target": {
"exec_alias": "exec",
"node_id": 24
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 18
},
"target": {
"exec_alias": "exec",
"node_id": 1
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 19
},
"target": {
"exec_alias": "exec",
"node_id": 1
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 20
},
"target": {
"exec_alias": "exec",
"node_id": 1
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 21
},
"target": {
"exec_alias": "exec",
"node_id": 1
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 22
},
"target": {
"exec_alias": "exec",
"node_id": 1
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 23
},
"target": {
"exec_alias": "exec",
"node_id": 1
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 24
},
"target": {
"exec_alias": "exec",
"node_id": 1
}
},
{
"source": {
"exec_alias": "exec",
"node_id": 25
},
"target": {
"exec_alias": "exec",
"node_id": 1
}
},
{
"source": {
"exec_alias": "false",
"node_id": 17
},
"target": {
"exec_alias": "exec",
"node_id": 26
}
},
{
"source": {
"exec_alias": "false",
"node_id": 26
},
"target": {
"exec_alias": "exec",
"node_id": 1
}
},
{
"source": {
"exec_alias": "true",
"node_id": 26
},
"target": {
"exec_alias": "exec",
"node_id": 25
}
}
],
"nodes": [
{
"alias": "on_intercept_request",
"definition_id": "caido/on-intercept-request",
"display": {
"x": -20,
"y": -100
},
"id": 0,
"inputs": [],
"name": "On intercept request",
"version": "0.1.0"
},
{
"alias": "passive_end",
"definition_id": "caido/passive-end",
"display": {
"x": -30,
"y": 1830
},
"id": 1,
"inputs": [],
"name": "Passive End",
"version": "0.1.0"
},
{
"alias": "pwnfox_blue",
"definition_id": "caido/httpql-matches",
"display": {
"x": -20,
"y": 20
},
"id": 2,
"inputs": [
{
"alias": "query",
"value": {
"data": "req.raw.cont:\"X-PwnFox-Color: blue\"",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "PwnFox: blue",
"version": "0.1.0"
},
{
"alias": "pwnfox_cyan",
"definition_id": "caido/httpql-matches",
"display": {
"x": -20,
"y": 120
},
"id": 3,
"inputs": [
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
},
{
"alias": "query",
"value": {
"data": "req.raw.cont:\"X-PwnFox-Color: cyan\"",
"kind": "string"
}
}
],
"name": "PwnFox: cyan",
"version": "0.1.0"
},
{
"alias": "pwnfox_green",
"definition_id": "caido/httpql-matches",
"display": {
"x": -20,
"y": 220
},
"id": 4,
"inputs": [
{
"alias": "query",
"value": {
"data": "req.raw.cont:\"X-PwnFox-Color: green\"",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "PwnFox: green",
"version": "0.1.0"
},
{
"alias": "pwnfox_yellow",
"definition_id": "caido/httpql-matches",
"display": {
"x": -20,
"y": 320
},
"id": 5,
"inputs": [
{
"alias": "query",
"value": {
"data": "req.raw.cont:\"X-PwnFox-Color: yellow\"",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "PwnFox: yellow",
"version": "0.1.0"
},
{
"alias": "pwnfox_orange",
"definition_id": "caido/httpql-matches",
"display": {
"x": -20,
"y": 420
},
"id": 6,
"inputs": [
{
"alias": "query",
"value": {
"data": "req.raw.cont:\"X-PwnFox-Color: orange\"",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "PwnFox: orange",
"version": "0.1.0"
},
{
"alias": "pwnfox_red",
"definition_id": "caido/httpql-matches",
"display": {
"x": -20,
"y": 520
},
"id": 7,
"inputs": [
{
"alias": "query",
"value": {
"data": "req.raw.cont:\"X-PwnFox-Color: red\"",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "PwnFox: red",
"version": "0.1.0"
},
{
"alias": "pwnfox_pink",
"definition_id": "caido/httpql-matches",
"display": {
"x": -20,
"y": 620
},
"id": 8,
"inputs": [
{
"alias": "query",
"value": {
"data": "req.raw.cont:\"X-PwnFox-Color: pink\"",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "PwnFox: pink",
"version": "0.1.0"
},
{
"alias": "pwnfox_magenta",
"definition_id": "caido/httpql-matches",
"display": {
"x": -20,
"y": 720
},
"id": 9,
"inputs": [
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
},
{
"alias": "query",
"value": {
"data": "req.raw.cont:\"X-PwnFox-Color: magenta\"",
"kind": "string"
}
}
],
"name": "PwnFox: magenta",
"version": "0.1.0"
},
{
"alias": "if_else",
"definition_id": "caido/if-else",
"display": {
"x": -20,
"y": 830
},
"id": 10,
"inputs": [
{
"alias": "condition",
"value": {
"data": "$pwnfox_blue.matches",
"kind": "ref"
}
}
],
"name": "is blue?",
"version": "0.1.0"
},
{
"alias": "if_else_1",
"definition_id": "caido/if-else",
"display": {
"x": 120,
"y": 920
},
"id": 11,
"inputs": [
{
"alias": "condition",
"value": {
"data": "$pwnfox_cyan.matches",
"kind": "ref"
}
}
],
"name": "is cyan?",
"version": "0.1.0"
},
{
"alias": "if_else_2",
"definition_id": "caido/if-else",
"display": {
"x": 400,
"y": 1080
},
"id": 13,
"inputs": [
{
"alias": "condition",
"value": {
"data": "$pwnfox_yellow.matches",
"kind": "ref"
}
}
],
"name": "is yellow?",
"version": "0.1.0"
},
{
"alias": "if_else_3",
"definition_id": "caido/if-else",
"display": {
"x": 540,
"y": 1170
},
"id": 14,
"inputs": [
{
"alias": "condition",
"value": {
"data": "$pwnfox_orange.matches",
"kind": "ref"
}
}
],
"name": "is orange?",
"version": "0.1.0"
},
{
"alias": "if_else_4",
"definition_id": "caido/if-else",
"display": {
"x": 260,
"y": 1000
},
"id": 15,
"inputs": [
{
"alias": "condition",
"value": {
"data": "$pwnfox_green.matches",
"kind": "ref"
}
}
],
"name": "is green?",
"version": "0.1.0"
},
{
"alias": "if_else_5",
"definition_id": "caido/if-else",
"display": {
"x": 680,
"y": 1260
},
"id": 16,
"inputs": [
{
"alias": "condition",
"value": {
"data": "$pwnfox_red.matches",
"kind": "ref"
}
}
],
"name": "is red?",
"version": "0.1.0"
},
{
"alias": "if_else_6",
"definition_id": "caido/if-else",
"display": {
"x": 820,
"y": 1340
},
"id": 17,
"inputs": [
{
"alias": "condition",
"value": {
"data": "$pwnfox_pink.matches",
"kind": "ref"
}
}
],
"name": "is pink?",
"version": "0.1.0"
},
{
"alias": "set_color",
"definition_id": "caido/color-set",
"display": {
"x": -30,
"y": 1060
},
"id": 18,
"inputs": [
{
"alias": "color",
"value": {
"data": "blue",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "Set Color",
"version": "0.1.0"
},
{
"alias": "set_color_1",
"definition_id": "caido/color-set",
"display": {
"x": 110,
"y": 1120
},
"id": 19,
"inputs": [
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
},
{
"alias": "color",
"value": {
"data": "#159f64",
"kind": "string"
}
}
],
"name": "Set Color 1",
"version": "0.1.0"
},
{
"alias": "set_color_2",
"definition_id": "caido/color-set",
"display": {
"x": 250,
"y": 1180
},
"id": 20,
"inputs": [
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
},
{
"alias": "color",
"value": {
"data": "green",
"kind": "string"
}
}
],
"name": "Set Color 2",
"version": "0.1.0"
},
{
"alias": "set_color_3",
"definition_id": "caido/color-set",
"display": {
"x": 390,
"y": 1250
},
"id": 21,
"inputs": [
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
},
{
"alias": "color",
"value": {
"data": "#9c9d0d",
"kind": "string"
}
}
],
"name": "Set Color 3",
"version": "0.1.0"
},
{
"alias": "set_color_4",
"definition_id": "caido/color-set",
"display": {
"x": 530,
"y": 1330
},
"id": 22,
"inputs": [
{
"alias": "color",
"value": {
"data": "orange",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "Set Color 4",
"version": "0.1.0"
},
{
"alias": "set_color_5",
"definition_id": "caido/color-set",
"display": {
"x": 670,
"y": 1390
},
"id": 23,
"inputs": [
{
"alias": "color",
"value": {
"data": "red",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "Set Color 5",
"version": "0.1.0"
},
{
"alias": "set_color_6",
"definition_id": "caido/color-set",
"display": {
"x": 810,
"y": 1470
},
"id": 24,
"inputs": [
{
"alias": "color",
"value": {
"data": "pink",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "Set Color 6",
"version": "0.1.0"
},
{
"alias": "set_color_7",
"definition_id": "caido/color-set",
"display": {
"x": 1060,
"y": 1510
},
"id": 25,
"inputs": [
{
"alias": "color",
"value": {
"data": "purple",
"kind": "string"
}
},
{
"alias": "request",
"value": {
"data": "$on_intercept_request.request",
"kind": "ref"
}
}
],
"name": "Set Color 7",
"version": "0.1.0"
},
{
"alias": "if_else_7",
"definition_id": "caido/if-else",
"display": {
"x": 970,
"y": 1430
},
"id": 26,
"inputs": [
{
"alias": "condition",
"value": {
"data": "$pwnfox_magenta.matches",
"kind": "ref"
}
}
],
"name": "is magenta?",
"version": "0.1.0"
}
]
},
"id": "a67ef37b-306e-47fd-bdc5-8971c55def8c",
"kind": "passive",
"name": "PwnFox Support"
}
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.