(WIP) Evaluating Firefox Extensions

Table of contents

Easy Screenshot 3.109

Starting off by looking at Easy Screenshot, there are several folders, but our interest is on understanding the function of the script.js files.

manifest.json has some helpful info about the makeup of the manifest.json file.

└── 📁easyscreenshot-3.109
    └── 📁_locales
    └── 📁background
        └── 📁audio
        ├── page.html
        ├── script.js
    └── 📁common
        ├── script.js
        ├── style.css
    └── 📁content
        ├── script.js
    └── 📁editor
        └── 📁img
        ├── page.html
        ├── script.js
        ├── style.css
    └── 📁icons
    └── 📁META-INF
    └── 📁popup
        ├── page.html
        ├── script.js
        ├── style.css
    └── manifest.json

File	Description	Image
common/script.js	runs the crop overlay
content/script.js	decides whether to start the crop overlay depending on the user choice
background/script.js	handles opening of different pages and manages download and errors
popup/script.js
editor/script.js	defines the editor that comes up when the screenshot is taken

Based on my examination, there is no indication of malicious intent or a C2 server as I might have expected to see if this program was intented to cause harm. The main cause for concern is that it can “Access your data for all web sites”, and it could well be sending that data elsewhere, but I found no indication that it was doing this.

Browsec VPN

└── 📁browsec-3.92.7
    └── 📁_locales
    └── 📁fonts
    └── 📁images
        └── 📁android_app
            ├── phone.jpg
        └── 📁congratulations
            └── 📁chrome
            └── 📁others
        └── 📁favorites
        └── 📁flags
        └── 📁help
        └── 📁icons
        └── 📁menu
        └── 📁pings
        └── 📁popup-help
        └── 📁promos
        └── 📁smart_settings
        └── 📁unblock_proxy
        ├── exclamationPointIcon.ts
        ├── index.ts
        ├── popupCloseIcon.ts
    └── 📁META-INF
    └── 📁pages
        └── 📁congratulations
            ├── congratulations.html
            ├── congratulations.js
        └── 📁diagnostics
            ├── diagnostics.html
            ├── diagnostics.js
        └── 📁firefoxAgreeConditions
            ├── firefoxAgreeConditions.html
            ├── firefoxAgreeConditions.js
        └── 📁help
            ├── help.html
            ├── help.js
    └── 📁popup
        └── 📁styles
            ├── popup.css
        ├── popup.html
        ├── popup.js
    └── 📁styles
    ├── background.js
    ├── background.ts.LICENSE.txt
    ├── browsecSiteContentScript.js
    ├── common.js
    ├── lodash.js
    ├── manifest.json
    ├── notification.js
    ├── polyfills.js
    ├── promoPageExecutor.js
    ├── promoPageExecutor.ts.LICENSE.txt
    └── timezoneChange.js

The .ts files are just more CSS.

Adblock Plus