Skip to content

added abitlity to inject scripts in head or body#1157

Open
callightmn wants to merge 2 commits into
kgretzky:masterfrom
vaadata:feature/js_head
Open

added abitlity to inject scripts in head or body#1157
callightmn wants to merge 2 commits into
kgretzky:masterfrom
vaadata:feature/js_head

Conversation

@callightmn

@callightmn callightmn commented Jan 19, 2025

Copy link
Copy Markdown

Hi,

This PR adds the ability to inject JS scripts at the end of the <head> section instead of the <body> section, which may be useful to execute the script before the page finishes loading. For instance, recently, I tried to deactivate a button but since the page took quite some time to load completely, most users could still click on the button because my injected script had not yet been executed. The default behavior is still to inject at the bottom of the body section but I added an optional location parameter in js_inject to pick 'head' or 'body':

Phishlet snippet:

js_inject:
  - trigger_domains: ["akira.lab.evilginx.com"]
    trigger_paths: ["/"]
    location: "head"
    script: |
      function lp() {
        checkbox = document.querySelector("#rememberCheck");
        if (checkbox != null) {
          checkbox.checked = true;
          return;
        }
        setTimeout(lp, 100);
      }
      lp();

Injecting in head (location: 'head'):

image

Injecting in body (location: 'body' or no location):

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@callightmn