loading
Loading content
loading
Scanners
Black Hat Arsenal Chrome extension analysis: static rules, permission review, and optional enrichment.
overview
threatxtension unpacks a Chrome extension and reports what it can do rather than what its listing claims. It runs static analysis over the bundled JavaScript, reads the manifest permission set, and scores entropy to flag packed or obfuscated payloads, which is the shape most malicious extensions take once they are past review.
Three input ports decide what gets analyzed. --file takes a local zip or crx and is the path to use for an extension you already hold or one your workflow seeded. --id and --url resolve an item from the Chrome Web Store instead. Two optional vault keys add enrichment: a VirusTotal key for reputation and an OpenAI key for a written summary of the findings.
The node emits findings.jsonl, so an extension review becomes a schedulable check instead of a one-time read. The Browser Extension Threat Scanner seeds a demo MV3 bundle and correlates the output, and swapping the seed for your own allow-list is the whole change needed to point it at a real fleet.
use cases
Analyze the zip or crx and read the permission set and static findings before the extension lands on managed browsers.
Pass the extension id or its store URL to pull and analyze the published bundle without downloading it by hand.
Use the entropy signal to separate ordinary minified code from bundles that are hiding what they load at runtime.
Schedule the scan across the extensions you permit so a quiet update that widens permissions shows up as a new finding.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| file | FILE | --file | Local extension zip/crx (preferred BYO) |
| id | STRING | --id | Chrome extension id |
| url | STRING | --url | Chrome Web Store URL |
Showing key inputs. threatxtension exposes 5 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| file | FILE | --file | Local extension zip/crx (preferred BYO) |
| id | STRING | --id | Chrome extension id |
| url | STRING | --url | Chrome Web Store URL |
| openai-api-key | STRING | --openai-api-key | Vault secret BH_OPENAI_API_KEY (optional LLM summary) |
| virustotal-api-key | STRING | --virustotal-api-key | Vault secret BH_VIRUSTOTAL_API_KEY (optional) |
example
# analyze a local bundle (preferred for BYO extensions)threatxtension --file extension.zip # or resolve a published item by idthreatxtension --id abcdefghijklmnopabcdefghijklmnop{ "tool": "threatxtension", "extension": "example-extension", "manifest_version": 3, "permissions": ["tabs", "<all_urls>", "scripting"], "finding": "remote script fetched at runtime", "entropy": 7.4, "severity": "high"}guidance
Reach for threatxtension when the artifact is a browser extension and you want manifest, static, and entropy signals in one pass. Use semgrep-scan when you have the unpacked source and want your own rules, and use trufflehog when the question is only which credentials are baked into the bundle.
Custom pattern rules over unpacked source. More control, no manifest or Web Store awareness and no entropy scoring.
Finds and verifies secrets inside the bundle. Narrower question, and it says nothing about the permission surface.
Template checks against reachable services. Useful for the endpoints an extension talks to, not for the extension package.
workflows
faq
related
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
Reflection triage for parameter URLs during recon.
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
CMS detection and version fingerprinting.
Signature-driven web application scanner.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
A packed extension or a store id feeds threatxtension, which writes manifest, static, and entropy findings for review.
Facts on this page come from the live Trickest tool library.