webstrike
WebStrike 是一套以 Chromium 系浏览器扩展（Manifest V3） 为受控端点的指挥与控制（C2）套件。与传统以进程/驱动为主的 C2 相比，其工作重心落在 浏览器安全域：在合规授权与攻防演练场景下，可显著降低与终端 EDR 在 进程注入、驱动、内核回调 等层面的直接对抗成本，同时将能力锚定在用户 真实访问的 Web 会话 上。
A browser extension based command and control framework for authorized red team engagements, letting a tester remotely control and collect data from a target's Chrome browser.
WebStrike is a command and control framework built specifically for authorized security testing and red team exercises. Instead of controlling a computer process the way most command and control tools do, it controls a Chromium browser extension, meaning its point of contact is the browser itself rather than the operating system. The README states plainly that it is intended only for legal, authorized use and includes a disclaimer requiring users to have written permission before testing any system.
The project has three main parts. A management platform lets an operator see every connected browser, view details like IP address, operating system, and browser version, and issue commands. Real time control lets an operator watch a live view of the target's currently open browser tab, navigate it to new pages, click on elements, fill in forms, take screenshots, and read the page's underlying structure. A task system lets an operator collect data asynchronously, such as saved cookies, browsing history, bookmarks, installed extensions, and clipboard contents, and even set rules to rewrite text copied to the clipboard within chosen websites.
Because the extension has access to a logged in browser, the platform also includes a session takeover feature: an authorized operator can reuse a target's existing login session on sites like Gmail or Outlook without re entering a password, which the README ties back to authorized red team scenarios. Two additional tools support deploying the extension. One installs the browser extension silently on a target machine that has already granted the tester execution access, without needing developer mode or administrator rights. Another extracts the source code of an extension already installed and trusted on a target's browser so a tester can repackage it to look legitimate.
The project is written mainly in Python for the server side, alongside JavaScript for the browser extension itself. It is licensed under the GNU AGPL 3.0. This tool is intended for penetration testers and red team professionals working within a legal, authorized engagement, not for general developers or casual users, and requires familiarity with security testing methodology and infrastructure setup.
Where it fits
- Simulate a browser based attack path during an authorized red team engagement.
- Test how well an organization's endpoint security detects browser extension based control.
- Study session and cookie based attack techniques for security research purposes.
- Practice deploying and managing a command and control agent in a lab environment.