Seems like a cool project, can't wait to fork this.
You can use crxextractor.com to get the extension into a .crx format, then after upload the .crx file back onto the website to get the source code (.zip file). Of course you'll still need to deobfuscate anything that's obfuscated IF the author did so (e.g javascript), however it provides a way to to get the source code. And no, you don't need to execute anything anything on your device.
Would be cool to see the logic behind this one.
Update: Can confirm the source code isn't obfuscated, should be easy for even beginners to understand. Uses regex to find and match any leaked API keys existing on the site. Includes a regex to match a generic format and also formats for popular sites.
Snippet from background.js to make it self-explanatory how it works:
"...let specifics = {
"Slack Token": "(xox[pboa]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
"RSA private key": "-----BEGIN RSA PRIVATE KEY-----",
"SSH (DSA) private key": "-----BEGIN DSA PRIVATE KEY-----",
"SSH (EC) private key": "-----BEGIN EC PRIVATE KEY-----",
"PGP private key block": "-----BEGIN PGP PRIVATE KEY BLOCK-----",
"Amazon MWS Auth Token": "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
"Json Web Token" : "eyJhbGciOiJ",
"MailChimp API Key": "[0-9a-f]{32}-us[0-9]{1,2}",
"Mailgun API Key": "key-[0-9a-zA-Z]{32}",
"Password in URL": "[a-zA-Z]{3,10}://[^/\\s
]{3,20}:[^/\\s]{3,20}@.{1,100}[\"'\\s]",
"PayPal Braintree Access Token": "access_token\\$production\\$[0-9a-z]{16}\\$[0-9a-f]{32}",
"Picatic API Key": "sk_live_[0-9a-z]{32}",
}
let generics = {
"Generic API Key": "[aA][pP][iI]_?[kK][eE][yY].{0,20}['|\"][0-9a-zA-Z]{32,45}['|\"]",
"Generic Secret": "[sS][eE][cC][rR][eE][tT].{0,20}['|\"][0-9a-zA-Z]{32,45}['|\"]",
}
let aws = {
"AWS API Key": "((?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16})",
}..."
(Jan 18, 2024, 05:06 AM)Kraxs Wrote: Open source?
You can use crxextractor.com to get the extension into a .crx format, then after upload the .crx file back onto the website to get the source code (.zip file). Of course you'll still need to deobfuscate anything that's obfuscated IF the author did so (e.g javascript), however it provides a way to to get the source code. And no, you don't need to execute anything anything on your device.
Would be cool to see the logic behind this one.
Update: Can confirm the source code isn't obfuscated, should be easy for even beginners to understand. Uses regex to find and match any leaked API keys existing on the site. Includes a regex to match a generic format and also formats for popular sites.
Snippet from background.js to make it self-explanatory how it works:
"...let specifics = {
"Slack Token": "(xox[pboa]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
"RSA private key": "-----BEGIN RSA PRIVATE KEY-----",
"SSH (DSA) private key": "-----BEGIN DSA PRIVATE KEY-----",
"SSH (EC) private key": "-----BEGIN EC PRIVATE KEY-----",
"PGP private key block": "-----BEGIN PGP PRIVATE KEY BLOCK-----",
"Amazon MWS Auth Token": "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",
"Json Web Token" : "eyJhbGciOiJ",
"MailChimp API Key": "[0-9a-f]{32}-us[0-9]{1,2}",
"Mailgun API Key": "key-[0-9a-zA-Z]{32}",
"Password in URL": "[a-zA-Z]{3,10}://[^/\\s
]{3,20}:[^/\\s]{3,20}@.{1,100}[\"'\\s]","PayPal Braintree Access Token": "access_token\\$production\\$[0-9a-z]{16}\\$[0-9a-f]{32}",
"Picatic API Key": "sk_live_[0-9a-z]{32}",
}
let generics = {
"Generic API Key": "[aA][pP][iI]_?[kK][eE][yY].{0,20}['|\"][0-9a-zA-Z]{32,45}['|\"]",
"Generic Secret": "[sS][eE][cC][rR][eE][tT].{0,20}['|\"][0-9a-zA-Z]{32,45}['|\"]",
}
let aws = {
"AWS API Key": "((?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16})",
}..."
