FYP Academic Security Research

Browser Hacking
Platform

A full-stack browser hacking platform for demonstrating attack vectors — payload delivery, popup engineering, browser extension injection, and victim session capture. Built as a Final Year Project for academic security research.

Enter Panel
Ethical Research Only
FYP Project
Laravel 10
xss_payload.js — attack simulation
JS
Execution
5
Core Modules
MV3
Extension API
100%
Dark Side
Framework Modules

Everything you need to test XSS

End-to-end attack simulation from payload injection to victim data harvesting — all in one panel.

Payload & Code Library
Build, manage, and deploy custom XSS payloads. The Code Library stores reusable JavaScript snippets — inject screenshot capture, cookie exfiltration, geolocation, and popup triggers with a single embed.
JS Injection Cookie Steal Screenshot Geolocation
Dynamic Popup Engine
Design custom overlay popups with a live browser preview. Style, content, delay, and button actions are all configurable. Link a Chrome extension to the download button — one click installs your implant.
Live Preview Delay Control Extension Link Embed Code
Chrome Extension Builder
Generate fully functional Manifest V3 Chrome extensions on the fly. Customise icon, content script, and background worker. When installed, the extension silently harvests all cookies and open tabs back to your panel.
Manifest V3 Cookie Harvest Tab Capture Dynamic ZIP
Victim Reports & Extension Data
Every triggered payload creates a linked report — IP, browser fingerprint, geolocation, page source, screenshot, and session cookies. Extension data (all browser cookies + tabs) is linked back to the same report via a session token.
Session Token Full Report Ext. Data Page Media Files
Attack Chain

How the payload chain works

Payload Fires
XSS injects script into victim browser, collects data + creates report
Popup Appears
Styled overlay shown to victim with a disguised download button
Extension Downloaded
ZIP generated with session token baked into background.js
Extension Installed
Victim installs extension — onInstalled fires immediately
Data Captured
All cookies + tabs sent back and linked to the original report