Browser Extension Reverse

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Browser Extension Reverse Engineering

When to Use

• Auditing a browser extension's behavior and permissions in an authorized review.
• Investigating how an extension handles credentials or sensitive page data.

适用场景

• Chrome/Edge MV2/MV3 扩展分析
• Firefox 扩展
• 恶意扩展 IOC、供应链扩展投毒调查
• 扩展实现的签名/加密/代理逻辑还原

工作流

1. 包体

□ crx 解压 / 从 profile 取扩展目录
□ manifest.json：permissions、host_permissions、background、content_scripts
□ 评估过度权限（<all_urls>、webRequest、debugger）

2. 逻辑

□ service_worker / background 入口
□ content_script 注入点与世界（isolated）
□ chrome.storage / IndexedDB 密钥
□ 与 `js-reverse` 相同：Observe 网络与消息传递（runtime.sendMessage）

3. 动态

□ 开发者模式加载解压目录
□ chrome://extensions 检查错误
□ DevTools 附加 service worker
□ 必要时 Frida/浏览器 CDP（jshookmcp）

工具链

参考

• references/extension-analysis.md
• field-journal 扩展恢复相关条目
• ../js-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R30
下游: 复杂混淆 JS → js-reverse；投毒调查 → supply-chain / malware

任务完成自检

• 是否列出权限面与入口脚本？
• 是否还原关键数据流？
• Checklist？

Limitations

• Extension stores update frequently; findings can go stale.
• Dynamic analysis requires a profile isolated from personal accounts.

Adapted from zhaoxuya520/reverse-skill (MIT).