JS-Tap Mark II: Attacking Web Apps With Even More Red Team Shenanigans

The talk presents JS-Tap Mark II, an open-source browser-side tool for red teams that began as a recon utility for watching tapped users. Version two adds a backend that scales beyond a single-threaded Flask app by using Gunicorn and Nginx, a C2 for queuing custom JavaScript tasks to connected clients, and Mimic, a feature that turns intercepted browser requests into stubbed-out replay scripts. The speaker explains implant mode for post-exploitation and trap mode for XSS, where a same-origin iframe keeps a victim engaged while the address bar is spoofed.

The demos cover a WordPress XSS trap that captured keystrokes and form posts, then used Mimic to add an administrator account. Monkey-patching XHR and fetch exposed API tokens and let a generic payload change a Defcon level through an authenticated call. An osTicket implant showed unprotected session cookies and session fixation, and a custom payload took the help desk offline.

For defenders, the talk recommends file integrity monitoring on servers, caution with third-party JavaScript, and a strict Content Security Policy set early without inline exceptions. Audience questions covered how victims break out of the trap through refreshes or cross-domain navigation, and the limits of this approach without XSS or server access.