search

abrahamjuliot / creepjs

Creepy device and browser fingerprinting
MIT License
1.53k stars 193 forks source link

Detect web extensions #106

Closed abrahamjuliot closed 2 years ago

abrahamjuliot commented 3 years ago

Detecting extensions in a chromium browser is rather candid. The manifest.json file can be viewed in a non-incognito window and under web_accessible_resources, the paths here are public, and then the list of public files can be obtained from the system folder.

For example, this will detect Grammarly

fetch('chrome-extension://kbfnbcaeplbcioakkpcpgfkobkghlhen/src/css/Grammarly.styles.css')
.then(() => console.log('extension found'))
.catch(error => console.log('extension not found'))

Chrome Profile Path is at chrome://version/

Steps to obtain resources:

How to get webstore links

Concept

getChromeExtensions = async () => {
    const extensions = {
        'aapbdbdomjkkjkaonfhkkikfgjllcleb': { name: 'Google Translate', file: 'popup_css_compiled.css' },
        'fake': { name: 'fake', file: 'broken.css' },
        'kbfnbcaeplbcioakkpcpgfkobkghlhen': { name: 'Grammarly', file: 'src/css/Grammarly.styles.css' },
        'kgjfgplpablkjnlkjmjdecgdpfankdle': { name: 'Zoom Scheduler', file: 'images/icon.svg'}
    }
    const urls = Object.keys(extensions).map(key => `chrome-extension://${key}/${extensions[key].file}`)
    const idMatcher = /\/\/([^\/]+)/
    const getName = res => extensions[idMatcher.exec(res.url)[1]].name
    console.log(urls)
    const result = Promise.all(urls.map(url => fetch(url).then(getName).catch(e => {}))).then(res => res.filter(x => !!x))
    return result
}
await getChromeExtensions()
abrahamjuliot commented 3 years ago

Firefox addons can be targeted and identified through JS and CSS behavior detection, but (as far as I know) the limit with this method is the behavior is not consistent across sites and the code is subject to change. But, with this method, it would still be easy to rate the probability of the extension being used based on known behavior.

abrahamjuliot commented 3 years ago

Source viewer: https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin

Popular:

Google Translate Adobe Acrobat Tampermonkey Avast Online Security Adblock Plus Adblock uBlock Origin Pinterest Save Button Cisco Webex Grammarly for Chrome Skype Avast SafePrice Honey

Bitwarded (3K+ stars): chrome-extension://nngceckbapebfimnlniiiahkandclblb/images/icon38.png Zoom Scheduler (900+ stars): chrome-extension://kgjfgplpablkjnlkjmjdecgdpfankdle/images/icon.svg

abrahamjuliot commented 3 years ago

Top categories:

https://chrome.google.com/webstore/category/ext/7-productivity

abrahamjuliot commented 3 years ago

uBO filters (cosmetic)

<div class="glx-teaser">glx-teaser</div>
<div class="inplayer-ad">inplayer-ad</div>
<div class="inplayer_banners">inplayer_banners</div>
<div class="in_stream_banner">in_stream_banner</div>
<div class="dbanner">dbanner</div>
<div class="preroll-blocker">preroll-blocker</div>
<div class="happy-inside-player">happy-inside-player</div>
<div>safe</div>
Niek commented 3 years ago

This can also be used to detect Chromium vs Chrome. The official Chrome build comes with a couple of extensions such as the cast one.

Thorin-Oakenpants commented 3 years ago

in Firefox what is shifted, or added, after constructor in iframe.contentWindow properties can be very telling

here is AdBlocker Ultimate (2nd highest number of users on Firefox)

abrahamjuliot commented 3 years ago

Nice. I might use that. I'm looking for a 2nd detection method to improve the current technique I'm working on in 8a8917d. Right now the section is focused on detecting resistance but it also detects extensions based on unique patterns in prototype lie details and relies on a stable set of APIs present with minimal extension settings.

Thorin-Oakenpants commented 3 years ago

here is AdBlocker Ultimate (2nd highest number of users on Firefox)

NFI why it came up as No. 2, it's actually No. 7. Adblock Plus is No. 1 and has the same result

abrahamjuliot commented 2 years ago

Initial concept is live at https://abrahamjuliot.github.io/creepjs/tests/extensions.html