Tool for Scanning Browser Extensions

This tool is designed to process Excel files, focusing on Google Chrome and Mozilla Firefox browsers. It fetches permissions and other details of browser extensions from the Crxcavator API using etension IDs and writes the processed data to Excel files.

This tool can be used to scan browser extensions used througout an organization/team to find vulnerable or overly permissive extensions, the generated information can later be used to reduce the attack surface by deleting the insecure extensions or in any way intended.

Comparing two different files for Updates

This repository contains compare.py, a Python script designed to compare two Excel files generated by scanner.py over time. It identifies and outputs updated extensions by comparing their versions, enabling organizations or teams to efficiently track and remediate vulnerable or overly permissive extensions.

Comparing files:

• To compare a file, use the following command, replacing <file_name_old.xlsx> and <file_name_new.xlsx> with the path to your Excel files respectively:

python3 compare.py `<file_name_old.xlsx>` `<file_name_new.xlsx>`

To utilize compare.py, all prerequisites are the same as those already mentioned below. This includes having Python installed, cloning the repository, and running the script with the specified paths to the two Excel files as arguments. This tool plays a vital role in ensuring a secure environment by continuously monitoring and addressing extension vulnerabilities.

Locating Extension IDs

Chrome: To find the ID of a Chrome Extension, go to the extension's page on the Chrome Web Store and take note of the last segment of the URL. For example, in the URL https://chrome.google.com/webstore/detail/lastpass-free-password-ma/hdokiejnpimakedhajhdlcegeplioahd, the ID is hdokiejnpimakedhajhdlcegeplioahd.

Firefox: The ID of a specific extension can be found in its manifest.json file. This file contains various metadata about the extension, including its unique ID.

Credits

Credit for the API and platform belongs to CRXcavator by DUO Security (https://crxcavator.io/). This script automates interactions with their API.

Installation

git clone https://github.com/Ephemaral/extension_scanner.git

cd extension_scanner

pip install -r requirements.txt

Usage

1. Prepare Your Excel File:

   • Your Excel file should contain Extension IDs in a single cell separated by commas or in multiple cells. Ensure there is no other data in the sheet.

2. Run the Scanner:

   • To scan a file, use the following command, replacing <file_name.xlsx> with the path to your Excel file:

python3 scanner.py <file_name.xlsx>

• For testing purposes, you can use the provided test file:

python3 scanner.py test.xlsx

Prerequisites

• Python 3: Ensure you have Python 3 installed on your system.
• Excel File: Prepare an Excel file with Extension IDs. The file can contain IDs in a single cell separated by commas or in multiple cells.

Additional Tips

• Single Extension ID: If you only want to scan a single Extension ID, you can directly use the CRXcavator website (https://crxcavator.io/), which supports Google Chrome, Firefox, and Opera.
• Contributions: Feel free to contribute to this project by submitting pull requests or reporting issues.
• For Files With Additional Data: If your excel file contains extra data try rewriting the file_prep() function in a way that column_name matches with the one in your excel file.

Roadmap Items

• Code Optimisation
• Dockerization
• Automate Mitigation(Removing/Whitelisting Extensions)
• Store Last Accessed Index to avoid redundant scanning

License

This project is licensed under the MIT License. See the LICENSE file for details.