Hacking Electron Applications

[@PwnFunction]

This video is kinda old, a lot have changed since then. Many things don't apply to today's reality so I'll be doing an updated video in the near future, stay tuned. Starting from Electron 5.0+, `nodeIntegration` is disabled by default. github.com/electron/electron/blob/master/docs/api/breaking-changes.md#new-browserwindow-webpreferences-

[@masonfuller9823]

I started watching your channel and i wanted to ask you what color pallet you were using.

[@destroyer-tz2mk]

Hi there! That link doesn't work, look into this link for more information www.electronjs.org/blog/electron-5-0#security-improvements

[@berndeckenfels]

Would be good if there is also a restrictive CSP active

[@A453]

And I manually enable nodeIntergration in all my Electron apps lol

[@angryman9333]

still waiting

[@LiveOverflow]

Nice!!! First video I see from you. And your drawing style is already better than mine :P Good job :)

[@birb9254]

Hey fabian can you please continue your web hacking series plss

[@pedrohenriquecardoso1076]

His videos really look like yours, that's one of the things that caught my attention haha

[@PwnFunction]

Thank you!

[@masonfuller9823]

Does he use the same drawing pad as you?

[@RubyPiec]

I feel like that makes your videos good

[@_JohnHammond]

YEEEAAAAHHHH!!!

[@pedrohenriquecardoso1076]

I love your channel's Easter eggs in his videos haha

[@sonyreview2270]

concatenate your knowledge with @PwnFunction

[@basix250]

Protip: most Electron applications comes with default devtools shortcut

[@lilspelunker5613]

Coming from liveoverflow's video, that drawing is awesome

[@sqUamoNe]

Whoa this is quality content! Thank you so much!!!

[@lennystudios3.14]

This is epic After watching your newer videos I decided to watch some of these and I was not disappointed. Amazing that you were still this good at making videos 3 years ago Correction: 2 yrs I can’t count

[@IsfarTausif]

these videos look so aesthetic

[@abdilahrf]

Can you share the electron app and the raw payload so all of us could try the step by step practically ? Thanks for the good video (Y)

[@NekoOverflow]

Great video! A quick note in case it helps, there is a bumping sound on the left channel of the audio on your videos and is more noticeable wearing headphones. Depending on the source of the sound, a pop filter or shock absorbing mount for your mic would make your video as pleasing to listen to as it is to watch. 😊

[@PwnFunction]

Thanks! hopefully it won't be an issue from the next videos.

[@NekoOverflow]

@@PwnFunction I'm looking forward to them!

[@B4fb]

dude... you blow my mind. this is awesome....

[@tismoKIas]

really enjoy your videos :) may I ask what you use for the graphical parts of your videos? looks really cool

[@PwnFunction]

Adobe Animate

[@Sypacks]

this is amaaazing do more please . also doing course on youtube would be cool

[@vltraheaven7943]

I love this channel. The brain dumps are top notch.

[@roguesecurity]

Great video!!! Thanks for sharing. +1 like and subscriber

[@sakyb7]

Crazy.... You guyz are awesome.. loved it.. ❤️ From 🇮🇳

[@premagrawal9926]

Soo much to learn from you , Hats off Dude

[@Mooshroom42]

Your videos are very good, keep it like that!

[@IQUBE]

awesome video! which software do you use for drawing lol

[@videotoblin]

he said he uses Adobe Animate 2021 in a reply to a comment under one of the binary exploitation videos

[@codechapter6960]

Nice i learnt something todayy Had to happen some day.

[@MrJestervoodoo]

Great work guys. Simple put.

[@d3psi488]

"It was basically an API?" sure looks a lot like OpenID Connect to mee :D

[@DeveloVooshGWeb]

This is why Discord Desktop is stupid

[@berndeckenfels]

That was a bit unspecific, is there a writeup?

[@DeepThinker193]

This channels got me paranoid man

[@vamidicreations]

Hi nice video, but I am still a bit confused. what if you have a desktop application only? Is it still advised turning it off? because if you turn it on you can use the desktop API stuff. Also if you don't keep user personal stuff in the localstorage you should be fine right? also if your app is not a server then you are also set to go right?

[@SimonBuchanNz]

In short, enforce that you can't get simple XSS with content security policy and you can be pretty safe with node integration, but secure electron apps are still tricky, prefer defense in depth and try to stick to defaults. The current recommendation is use the IPC modules to get the main process to do everything interesting, but they are a bit fiddly, and you're still on the hook for the exposed IPC protocol to not allow bad stuff, eg no read-file request!

[@davyrogersuk]

Wonderful! Great content! :-)

[@m4rt_]

btw discord and element has their developer tols enaled btw

[@tauon_]

almost all have devtools on lmao

[@russianyoutube]

Nah, they disabled it. It works on ptb and canary tho

[@NillKitty]

I guess I'm a little confused as to how we're able to validate anything you're saying if you won't even tell us the name of the platform involved. I could make a few videos where I find security holes in a fabricated web app too.

[@Dank]

I knew this was gonna be discord from the title

[@sulochanakharat9033]

Sir please make more vedios like this 🙏🙏

[@narendrajayram1317]

Nice video. Can you share the final message that you sent it in the last? I did not understand how to bind client/access tokens, UID, GUID and RCE payload together?

[@zentreax]

What OS are you using?

[@zentreax]

@k4b00m yes but what distro? 😂

[@PwnFunction]

Windows at the moment, but I'll be getting a mac soon.

[@puravida012]

Good content but the public prefer no 0 days with out information, is better fresh patches cases but with the details

[@curias7]

what app you used to create this video

[@russianyoutube]

He used adobe animate cc

[@abinthomas12914]

Name a best alternative secure like javafx which I am aware. Which I also aware decompiled easy or use Obfuscate. I need a secure non reverse engineerable application. Can anybody give good advice

[@TruongVu-s7w]

You can use 7zip to decompress the asar file

[@hemantsahu4757]

Can I make hackerrank type platform in my own website using this?

[@ParasiteDelta]

So, people had the *BRILLIANT* idea to shove a dedicated browser (Chromium, no less) running a web-app with system-level hooks and extensibility, alongside the forceful system integration known as NodeJS (doing things we shouldn't be doing since the turn of the century, woo) into the general userspace and call it a proper program, all while patching none of the existing vulnerabilities out nor addressing the issue of *running a dedicated Chrome install with system hooks and permissions layered with NodeJS* and calling it """efficient""", god forbid performant. Fast-forward two to three years, and I want to put my head through a brick wall. Not only are pseudo-apps (my own little term for them, since they forcibly try to be something they're not) disturbingly commonplace, but people think that they're a valid gateway for the cross-compatibility angle that people seem to be focused on at the moment. Putting aside the fact that the world's web infrastructure is sadly immature and even prehistoric in certain areas, disregarding the fact that you're combining some of the most broken, forcibly-mutated, and ultimately vulnerable software into something that it isn't, and deploying it into an ecosystem where it doesn't belong, it's just utterly lazy and convoluted. Rather than focusing all of that energy and experimentation on developing legitimate cross-platform libraries and systems, people prefer to make a bloated web-app and have it run using a web browser specifically installed for that one program, then lazily craft C# hooks for pulling system resources and actions into the mix. Sorry for the rant, but goddamn, I'm tired of this craze. It's wrong, it's lazy and yet convoluted, and it's the incorrect approach. Evolution of systems begins by expansion and extrapolation, not by brute-forcing what's comfortable to many people (JS) into areas that shouldn't be involved (desktop development, systems-level I/O, etc.).

[@rodpadev]

Electron is way safer now then it used to be, and the so called "pseudo-apps" are very popular, Slack, VSCode, Postman, Skype and Discord, are built using electron, it's easy to make an unsafe app, but that's the thing, a good developer knows about the bad and builts accordingly. Your whole rant is weak and you should research a little about where JS is involved because believe it or not, JS is used for the frontend of the Dragon Crew Interface and it's used widely in embedded. Are there safer choices? Definitely. Are there faster choices? Of course there are. The reason why javascript is used everywhere is because it's fast, secure enough that only a beginner would expose it's app to high vulnerabilities and it's good a big community, the biggest I would say. So inform yourself sir.

[@user-he4ef9br7z]

But how are soydevs going to impress their mommies if they need to learn everything from the ground up to make their little apps? They need frameworks to build bloated websites which take an eternity to load and they need to build slow apps with lots of cute buttons. Are you suggesting people actually LEARN the os apis and use some C to make things secure and fast? Luddite!

[@rodpadev]

@@user-he4ef9br7z I'm saying that you could very well re-invent the wheel, but you most probably are not going to and if you are then yes you're going do it your way but by the time your wheel is rolling, everyone else is way ahead of you.

[@user-he4ef9br7z]

@@rodpadev Doing it your way used to be what programming was about. If you don't need to learn much to build stuff and just use a framework built by a mega large corporation, in turn making things slow, memory intensive and less secure, it might be time to question whether you're more of a consumer than a creator. Sure, some cooking website startup can afford to download a bloated framework, but in places where what you write actually matters, like embedded, robotics, space exploration, military, cryptography, let's just say you ain't gonna be using typescript. It's not about reinventing the wheel, it's about making the product vs using a product.

[@YumekuiNeru]

found it a littlebit dishonest to say that it works "just by visiting a message in the browser" when it actually is the application running in the background that is the issue.

[@renify_]

2020 still watching

[@codewarrior4458]

so how can one avoid this??

[@roopakparashar8278]

You are a great tutor I wonder how do you know so much I have just started in hacking and I feel so over this if I don't find a vulnerability, so can you tell me how you started

[@supersaiyan0x016]

Loved it ❤

[@VincentDegrave]

Nice! Thanks

[@FantasM]

Wow great job !!

[@hadyelzayady]

Great video but I will appreciate if you upload the used resources (exploit and volun app)

[@PwnFunction]

I'll keep that in mind for the next video.

[@ea9849]

Let's destroy notion and discord.

[@asafcohen3562]

Nice vid man

[@goncalomarques7022]

bro dammm that was just perferccttttt

[@syn3rman65]

Yaaasss

[@alibarznji2000]

I love this channel

[@1ali1996]

heyyy u guys awesome ...

[@heycherry100]

I love it!

[@aarav3890]

Really well done!

[@OussamaAmri]

Nice job :) great !

[@osamazaid25]

nice

[@jimcolabuchanan6579]

Very good video.

[@saeidanwar8587]

You are lit bro

[@samnkh2269]

is it just me or is the audio fk*d up? so painful listening to it..

[@samnkh2269]

like the mic has a broken wire or something

[@russianyoutube]

True

[@harshjaiswal1245]

Nice one guys ;)

[@ac11dc110]

wow.. thanks microsoft : )

[@ujjavalsinghvlog7545]

+__+ Awesome Video make more

[@galitan5881]

"decomiple"

[@ulissemini5492]

i always knew electron apps were not to be trusted!

[@RAGHAVENDRASINGH17]

Need more detail

[@NillKitty]

Yeah. Like what service this even is targeting, in what other ways it was broken that led to this, and how those items were eventually fixed.

[@xar512]

I SAID THIS TO MY FRIEND BEFORE =) HAHA

[@cobalt2489]

Anyone Tauri gang?

[@tauon_]

betterdiscord is cooler

[@ahmedalyasiri8795]

Anddddd this video is useless now by just don't (nodeIntegration: false) & use new feature called contextBridge in Electron ........ PEACE SON!!

[@mw3653]

This is literally worthless. Stop spreading misinformation.

[@tauon_]

It’s not.

[@russianyoutube]

You seem to not know what you are saying.

[@lucass8119]

If you're going to say something is "misinformation", you have to explain WHY its misinformation. Otherwise we will assume that, at best, you don't know what you're talking about. Or, at worst, you are intentionally deceitful.