Loading repository data…
Loading repository data…
kevin-mizu / repository
A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
From extension stores:
Manual installation:
Download the latest release: https://github.com/kevin-mizu/domloggerpp/releases/
about:debugging#/runtime/this-firefox and click on Load Temporary Add-on.chrome://extensions/, enable Developer mode and click on Load unpacked.if you want to build the extension by yourself, check the app folder.
class, function, attribute, event).match, !match, matchTrace, !matchTrace).exec:).beforeEnter; afterEnter).alert, notification).requiredHook).https://github.com/kevin-mizu/domloggerpp/assets/48991194/d6ac9f90-0f44-4cd2-a5e6-890cd44b0aeb
Custom filter buttons: Dynamically generated from your custom settings, these buttons facilitate log filtering.Data/Canary search bar: Easily filter and highlight logs using specific criteria related to a sink's args data.Advanced column search: Tailor your search to specific column criteria, like sink=innerHTML;frame=top, for more refined results.Global search bar: This default datatable feature enables searching across all columns.Debug button: Navigate directly to the page triggering the sink, with an automatic breakpoint for debugging.Log data management buttons:
Domains: Define allowed domains using regex to specify from which sites you'd like to receive logs.Hooking: Choose the hooking configuration to apply on the selected website.Misc: Enable or disable specific configuration settings.
PwnFox support: Allow all the PwnFox containers (Firefox only).Remove response headers: Removes response headers according to your configuration file.
https://github.com/kevin-mizu/domloggerpp/assets/48991194/0827eef3-6c16-42fc-b84d-d8ea16def6bf
Settings: Manage your hooking configurations - create, edit, modify, and remove as per your needs.Domains: Easily manage allowed domains, similar to the functionality in the popup menu.Webhook: Specify a remote host that will receive logs based on your configuration settings.Devtools: If you're using a backend server and prefer not to display information in your devtool panel, this section lets you disable that feature.Table: Personalize the devtools tables to align with your preferences.Customize: Personalize the application's theme to align with your preferences.{
"_description": "JSON config example",
"hooks": {
"category": {
"type_1": [ "sink_1", "sink_2" ],
"type_2": [ "sink_1", "sink_2" ]
}
},
"config": {
"*": {},
"sink_1": {
"match": [ "regex_1", "regex_2", "exec:return 'regex_3'" ],
"!match": [ "regex_1", "regex_2", "exec:return 'regex_3'" ],
"matchTrace": [ "regex_1", "regex_2", "exec:return 'regex_3'" ],
"!matchTrace": [ "regex_1", "regex_2", "exec:return 'regex_3'" ],
"beforeEnter": "return args",
"afterEnter": "return args",
"requiredHook": [ "type_2" ],
"alert": {
"match": [ "regex_1", "regex_2", "exec:return 'regex_3'" ],
"!match": [ "regex_1", "regex_2", "exec:return 'regex_3'" ],
"notification": true
},
"showThis": true
}
},
"globals": {
"Blacklist": [ "api", "app" ]
},
"onload": "console.log(1)",
"removeHeaders": [ "content-security-policy" ]
}
None of the specified keys in the configuration are mandatory; they can be manage to fit specific needs or omitted as desired.
This key aims to provide a way to insert notes within the configuration JSON itself. The value can be whatever you want as long as the JSON remains valid.
category: Acts as a filter in the devtools panel, helping you organize and identify the sinks.type_X: Specifies the type of sink you're targeting. The possible types are:
sink_X: This denotes the name of the sink that needs to be hooked, the notation varies based on type:
class & function: Use the target name directly, such as URLSearchParams.event: Only use the event name. For instance, for the onmessage event, simply use message.attribute: Prefix with set: or/and get: as appropriate. An example would be set:Element.prototype.innerHTML.sink: Refers to the target sink to be configured. It's essential for this to be present in the hooks section.match || matchTrace: An array of regular expressions. The parameters || stack trace of the sink must respect to these patterns.!match || !matchTrace: An array of regular expressions that the parameters || stack trace of the sink should not match.beforeEnter || afterEnter: This key should contain a raw JavaScript function that will be executed before/after the sink itself (and before any DOMLogger++ checks). The function receives 3 arguments: target, thisArg, and args, all of which refer to the currently identified sink. For example, using return [args[0] + '*2'] on eval('2') will result in 4.requiredHook: Specifies a list of hooks or sinks that must be triggered at least once before the target sinks start logging information. An example of this can be found in the leverage-innerHTML.json configuration file.alert: Triggers an alert badge on the extension icon based on specific conditions.
match & !match: Additional regular expressions that the sink parameters must respect to or avoid, respectively, in order to trigger the alert.notification: If set to true, a notification popup will appear when all conditions are satisfied.showThis: If set to true, the this= object will be logged in the context of a function call.Since version 1.0.4, it is now possible to use the exec: regex directive, which allows you to generate a regex from JavaScript execution. For instance: exec:return document.location.pathname.
For more detailed examples and insights, please refer to the configs folder.
The content of this key will be accessible in the domlogger.globals variable. It is designed to facilitate the modification of specific variables used in the exec: or beforeEnter or afterEnter directives. An example of its usage can be found in the cspt.json configuration file.
This key should contain a raw JavaScript function that will be executed after DOMLogger++ has loaded.
Thanks to this key, you'll be able to provide a list of response headers (in lower case) that you want to remove if the remove headers feature is enabled. This is especially useful for removing security headers during tests.
https://github.com/user-attachments/assets/9855e9e9-9c98-4284-821c-52d877390569
From any page
[ALT] + [SHIFT] + [P]: Opens the popup.[ALT] + [SHIFT] + [O]: Opens the options page.From the options config editor
[ALT] + [A]: Add a new config.[ALT] + [R]: Rename a config.[ALT] + [SHIFT] + [DELETE]: Delete a config.[ALT] + [A]: Add a new config.Not yet developed.
Many people helped and help DOMLogger++ become what it is and need to be acknowledged here!
villu164, @abdilahrf, @busf4ctor, @_Worty, owalid, @xanhacks, @kire_devs_hacks, aristosMiliaressis, @MtnBer, @FeelProud_sec, @jonathan404_, @PikuHaku, @aituglo, @xnl_h4ck3r, AetherBlack, @me0wday, @k1ng_pr4wn
Special thanks to @BitK_ for the well-structured code in Pwnfox, it helped me a lot to understand browsers extensions ❤️