Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-24 21:53:54 +00:00
Code Issues Projects Releases Packages Wiki Activity

GITBOOK-4350: No subject

Browse source
This commit is contained in:
CPol 2024-06-08 12:09:36 +00:00 committed by gitbook-bot
parent f6c6bc3627
commit bab9044c8c
No known key found for this signature in database
GPG key ID: 07D2180C7B12D0FF
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
pentesting-web/browser-extension-pentesting-methodology/README.md
View file

@ -574,7 +574,7 @@ An important consideration is that in scenarios where multiple pages are set to
When crafting new extensions, the preference should be towards promises as opposed to callbacks. Concerning the use of callbacks, the `sendResponse()` function is considered valid only if it's executed directly within the synchronous context, or if the event handler indicates an asynchronous operation by returning `true`. Should none of the handlers return `true` or if the `sendResponse()` function is removed from memory (garbage-collected), the callback associated with the `sendMessage()` function will be triggered by default.
## Sensitive Information in Memory/Code
## Sensitive Information in Memory/Code/Clipboard
If a Browser Extension stores **sensitive information inside it's memory**, this could be **dumped** (specially in Windows machines) and **searched** for this information.
@ -584,6 +584,8 @@ Of course, do **not put sensitive information in the code**, as it will be **pub
To dump memory from the browser you could **dump the process memory** or to go to the **settings** of the browser extension click on **`Inspect pop-up`** -> In the **`Memory`** section -> **`Take a snaphost`** and **`CTRL+F`** to search inside the snapshot for sensitive info.
Moreover, highly sensitive information like mnemonic keys or passwords **shouldn't be allowed to be copied in the clipboard** (or at least remove it from the clipboard in a few seconds) because then processes monitoring the clipboard will be able to get them.
## Loading an Extension in the Browser
1. **Download** the Browser Extension & unzipped