
Anti-MitM TLSCAPTCHA (PoC) Autor: Anon
This extension uses your CAPTCHA answer to verify TLS certificate that you get from website you're visiting. Warning: you can see it in action only if a website has server-side part of such verification scheme.
14 Users14 Users
Potrzebujesz Firefoksa, aby używać tego rozszerzenia
Metadane rozszerzenia
O tym rozszerzeniu
Every time when you solve CAPTCHA, the CAPTCHA answer can be used as a common secret for a short time. Mainly, It can be used to prevent TLS certificate spoofing.
Since ordinary web pages (and their JavaScript) doesn't have access to TLS certificate data, I was have to make this extension. Actually it does the following:
let clientsideDigest = <Digest of TLS certificate that you get from website you're visiting>;
let yourAnswer = <Your CAPTCHA answer>;
let resultDigest = PBKDF2(clientsideDigest, "SHA-512", yourAnswer);
//Where yourAnswer is PKBDF2 salt.
cookies["TLSCaptcha"] = representAsHexString(resultDigest);
To see it in action, you need to visit a website that have server-side implementation of this scheme.
At the moment of publishing this extension, there is no server-side implementations. If you want to make your own, please look into source code for details.
New additional featue: you can use this addon to establish additional encryption. See source code for details.
Since ordinary web pages (and their JavaScript) doesn't have access to TLS certificate data, I was have to make this extension. Actually it does the following:
let clientsideDigest = <Digest of TLS certificate that you get from website you're visiting>;
let yourAnswer = <Your CAPTCHA answer>;
let resultDigest = PBKDF2(clientsideDigest, "SHA-512", yourAnswer);
//Where yourAnswer is PKBDF2 salt.
cookies["TLSCaptcha"] = representAsHexString(resultDigest);
To see it in action, you need to visit a website that have server-side implementation of this scheme.
At the moment of publishing this extension, there is no server-side implementations. If you want to make your own, please look into source code for details.
New additional featue: you can use this addon to establish additional encryption. See source code for details.
Oceniony na 3 przez 2 recenzentów
Uprawnienia i daneWięcej informacji
Wymagane uprawnienia:
- Mieć dostęp do kart przeglądarki
- Mieć dostęp do danych użytkownika na wszystkich stronach
Więcej informacji
- Wersja
- 1.0.3
- Rozmiar
- 13,92 KB
- Ostatnia aktualizacja
- rok temu (17 maj 2024)
- Powiązane kategorie
- Licencja
- Tylko GNU General Public License v3.0
- Historia wersji
- Dodaj do kolekcji
Informacje o wydaniu 1.0.3
~ Content script is no more.
~ Works properly with 'insecure context'.
~ Breaking change: only PBKDF2 is supported as verification hash.
+ Experimental feature: encrypted content support.
~ Works properly with 'insecure context'.
~ Breaking change: only PBKDF2 is supported as verification hash.
+ Experimental feature: encrypted content support.
Więcej rozszerzeń od: Anon
- Nie ma jeszcze ocen
- Nie ma jeszcze ocen
- Nie ma jeszcze ocen
- Nie ma jeszcze ocen
- Nie ma jeszcze ocen
- Nie ma jeszcze ocen
WARNING: this extension cannot be ported to Chromium-based browsers due to API limitations.