Language: English
JS-Tap v3 moves beyond exploiting web applications to targeting the user’s endpoint itself. JavaScript is used heavily on desktops and in this hands-on workshop you'll deploy three new JS-Tap implant types against a Windows workstation on a simulated corporate network.
Start by installing a malicious browser extension that harvests sessions from every site the victim visits and injects payloads into specific application domains on command. We'll then add optional features that escape the browser sandbox for filesystem and shell access.
Next we'll patch a local Electron app for screenshots, keylogging, network interception, and message spoofing in a corporate chat platform. Then we'll instrument a Node.js CLI tool with a single environment variable to intercept its traffic and keystrokes.
Your operator system can't reach the internal corporate web applications directly. You'll use JS-Tap Conductor to pivot through an implant, demonstrating the full attack chain from session theft to authenticated access on an internal network.
All infrastructure is provided. Each participant gets a dedicated Windows victim machine and Linux operator box accessible via noVNC. Just bring a laptop with a browser and an ethernet adapter.
You'll leave with firsthand experience operating all three beacon types.
JS-Tap is an open-source JavaScript post-exploitation framework available since it's initial release at Wild West Hacking Fest in 2023. Version 3 adds three new endpoint-focused beacon types.
The BEX Beacon is a Chrome MV3/Firefox MV2 browser extension. It captures cookies including httpOnly via the browser cookies API, localStorage, sessionStorage, and request headers (Authorization, x-api-key, Cookie) for all visited domains. From the JS-Tap portal, operators can inject DOM Beacons into specific domains on command, turning the extension into a payload dropper. When spawned by a BEX Beacon, DOM Beacons gain higher quality screenshots via the extension's captureVisibleTab API over their built in screenshotting capability. Domain scoping via configurable allow lists ensures the beacon stays within engagement scope. Deployment scripts cover Chrome, Chromium, Edge, and Firefox browsers on MacOS, Linux, and Windows. Optionally install with administrative/root permissions to perform "enterprise policy" installations that cannot be modified by end users. An optional Sidecar feature, a cross-compiled Go binary communicating over the browser's native messaging protocol adds file system access and shell command execution to "escape" the browser sandbox, although this comes with opsec implications.
The Atom Beacon targets Electron desktop applications. The atomize.py patcher analyzes a target app's structure, security settings, and code signing status, then modifies the ASAR archive to inject the agent to the main process. The main process agent automatically injects renderer payloads into every BrowserWindow via webContents.executeJavaScript. The main process provides screenshots via Electron's desktopCapturer API with configurable auto-capture heuristics, cookie harvesting including httpOnly via the session cookies API, and HTTP request and response header interception via webRequest hooks. Renderer payloads capture keystrokes, inputs, form submissions, cookies, storage, URLs, HTML source, and XHR/Fetch network calls. Native file system access and shell execution are built in. A runtime plugin system supports app-specific attack modules loaded on demand from the portal. Currently included plugins are 1Password, Mattermost, Signal, Slack, and VSCode.
The V8 Beacon targets Node.js and Bun CLI applications via NODE_OPTIONS or BUN_OPTIONS environment variables. It monkey-patches http.request, https.request, globalThis.fetch, and http2.connect to intercept all outgoing network traffic with full request/response bodies including SSE streaming. It hooks process.stdin at multiple layers for keystroke capture and provides native file browsing and shell execution. Subprocess session sharing unifies parent and child processes under a single client, and cross-runtime filtering prevents ghost clients when Bun apps spawn Node.js subprocesses.
The beacon Proxy feature performs MITM TLS termination with dynamically generated per-domain certificates to route the operator's traffic through the target's network. JS-Tap Session Tickets export captured session data (cookies, headers, storage, User-Agent) as portable blobs, and the JS-Tap Conductor Firefox extension replays them locally, setting cookies, injecting headers, spoofing navigator properties, and populating storage. JS-Tap Proxy Tickets configure the Conductor to route traffic through the beacon's proxy, combining session identity with the target's network routing for fully authenticated session riding, useful for accessing internal web applications.
I'm still refining the workshop and will dry run it with volunteers in 1 month at my local meetup. My proxmox system can handle about 15 participants a run, I believe it will take an hour to do the workshop run. I can reset the the workshop pretty quickly in a few minutes, and am happy to do additional runs with more participants, but I believe from benchmarking that I'll likely cap out about 15 participants at a time.
Drew Kirkpatrick has 25 years of experience building complex systems across application security, ML, and aerospace. At TrustedSec, he applies penetration testing to assess client security posture. Previously: security researcher at NopSec and Secure Decisions, and senior computer scientist for the U.S. Navy. He holds an MS in Computer Science and an MS in Computer Information Systems from Florida Tech, plus OSCP, CRTO, GWAPT, and GMOB certs. Author of JS-Tap and OWASP Attack Surface Detector.