RedExt – Browser Extension-Based C2 Framework for Red Team Recon

RedExt is a browser extension-based Command and Control (C2) framework designed for authorised red team operations, built as a Manifest V3 Chrome extension with a Flask-based C2 server to enable deep browser-level data collection through a dark-themed dashboard. The system shifts the implant surface to the browser, a trusted yet under-monitored environment, making interception harder and reconnaissance more discreet.

Key features include cookie extraction with domain filtering for secure and HttpOnly cookies, browsing history capture with timestamps, titles and access methods, full-page screenshots, viewport and element-level captures, real-time clipboard monitoring with source URLs, DOM snapshots with dynamic content and resource mapping, LocalStorage export with domain context, and browser environment profiling alongside extension enumeration and hardware and network reconnaissance.

Installation requires Python and Chrome, with setup and run commands provided, and the extension can be loaded via Chrome’s Developer mode. In an attack scenario, a red team operator could install RedExt as an unpacked extension on a target’s Chrome session to harvest history, cookies, screenshots and clipboard data, all while masquerading as normal browser activity.

RedExt positions the browser as a high‑fidelity recon surface, offering a fresh offensive angle that defenders should monitor for suspicious extension behaviour.