PwnFox - PwnFox is a Firefox/Burp extension that provide us

项目说明

<img src="/firefox/icons/icon.svg" width=30> PwnFox

PwnFox is a Firefox/Burp extension that provide usefull tools for your security audit.

If you are a chrome user you can check

PwnFox

- Features
- Single click BurpProxy
- Containers Profiles
- PostMessage Logger
- Toolbox
- Security header remover
- Installation
- Build
- All
- Firefox
- Burp
- Changelog

Features

!popup

Single click BurpProxy

Connect to Burp with a simple click, this will probably remove the need for other addons like foxyProxy. However if you need the extra features provided by foxyProxy you can leave this unchecked.

Containers Profiles

PwnFox give you fast access to the Firefox containers. This allow you to ha identities in the same browser.
When PwnFox and the Add container header option are enabled, PwnFox will automatically add a X-PwnFox-Color header to hightlight the query in Burp.

PwnFoxBurp will automatically highlight and strip the header, but you can also specify your own behavior with addons like logger++.

!tabs
!burp

PostMessage Logger

PwnFox add a new message tab in you devtool. This allow you to quickly all postMessage between frames.


You can also provide your own function to parse/filter the messages.
You get access to 3 arguments:
* data -> the message data
* origin -> the window object representing the origin
* destion -> the window object representing the destination

You can return a string or a JSON serializable object.


Toolbox

Inject you own ja code on page load. The code will be loaded as soon as possible. This can used to add dangerous behavior detection, or just to add extra function to your js console.

Be carefull, the injected toolbox will run in the window context. Do not inject secret in untrusted domain.

!settings

I will publish some of my toolbox soon (ENOTIME)

Security header remover

Sometime it's easier to work with security header disabled. You can now do it with a single button press. Don't forget to reenable them before testing your final payload.

Headers stripped:
* Content-Security-Policy
* X-XSS-Protection
* X-Frame-Options
* X-Content-Type-Options

Installation

You can find the latest build here:
*

Firefox

- visit about:addons and choose install from file, then select PwnFox-$.xpi
- or install from

Burp

Go to extender and add PwnFox-Burp.jar as a ja.

Build

Firefox

Burp

Open and compile with Intellij IDEA

Changelog

* v1.0.3
* Fix missing highlight with burp v2021.4.2
* v1.0.2
* First public release

项目信息

开发语言：JavaScript

Star 数：1350

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PwnFox is a Firefox/Burp extension that provide usefull tools for your security audit.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。