A tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner.

Latest Version

Version
0.9.2
Update
May 21, 2021
Size
899KiB
Developer
Category
Users
582
Rating
4 ★
Manifest Version
2
Web Store Status
Languages Support
English (United States)
See more
Permissions

Storage
WebRequest
See more

Tracy Extension

There are many different ways to trigger XSS, especially considering the large number of frontend frameworks that have been made popular in the last few years. For example, some of the less traditional ways of exploiting XSS can be through:

* DOM clobbering
* DOM injection
* Frontend template injection
* Backend template injection
* Open redirects

These attack vectors are significantly different than traditional stored and reflected XSS cases and they require new tools for finding them effectively.

Many similar tools only look for server response reflection, however this is not very helpful if all output encoding is performed by the frontend. In order to really gain knowledge about all the true sinks of the application, we need a tool that grants us \"X-ray vision into the DOM\".

This extensions was written with the goal of eliminating XSS by assisting a penetration tester in identifying every source of input into an application and following that input to all of its sinks. These cases are documented and stored as references that can be used to identify the locations of potentially risky input.
Read more

Source Manifest.json

{
"update_url": "https://clients2.google.com/service/update2/crx",
"permissions":["",
"storage",
"webRequest"],
"background":{"scripts":["background.bundle.js"]},
"content_scripts":[{"matches":[""],
"all_frames":true,
"css":["page.css"],
"js":["content.bundle.js"],
"run_at":"document_start"}],
"browser_action":{"default_title":"Tracy",
"default_icon":{"16":"tracy_16x16.png",
"48":"tracy_48x48.png",
"96":"tracy_96x96.png",
"128":"tracy_128x128.png"}},
"web_accessible_resources":["page.bundle.js",
"databaseWorker.bundle.js",
"searchWorker.bundle.js"],
"manifest_version":2,
"name":"Tracy",
"description":"A tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner.",
"version":"0.9.2"}
Read more

How to download and manually install Tracy extension for Chrome

Looking for a way to install Tracy extensions for Chrome, you can search for them in the Chrome Web Store, clicking the "Add to Chrome" button, and following the straightforward process.

However, you may need to install Tracy extensions manually, this article outlines two simple methods to effortlessly install Tracy extensions, whether they come as unpacked folders in compressed formats like .zip or as .crx files.

Method 1: Download Tracy extension and manually install through Drag &Drop

If you ever need to manually install a Tracy extension for Chrome, don't worry, it's a simple process. Just follow these easy steps, and you will have your extension ready to use in no time.

Step 1: Download the Tracy Extension by clicking the "Download CRX" button on the website.

Look for the Tracy extension you wish to install. Go to the website and download the Tracy extension package, which is usually a .CRX file and comes in a zipped file. Here ".crx" file is the format for Tracy extension that contains all the data.

Step 2: Extract &Arrange Files

Once the file is downloaded, extract that file into its own folder. Similarly, give that extension files a permanent home. In other words, keep it in a folder that you don't accidentally delete it because these files will be needed to make that extension work.

Step 3: Go to the Chrome Extensions Page

Open Google Chrome and in the address bar, type chrome://extensions; it will open the Google Chrome extensions page. Make sure that "My extensions" is selected in the sidebar.

Step 4: Drag and Drop the Extension

Now, go to the folder where you extracted the Tracy extension and drag &drop the extension file from there anywhere onto the extension page within Google Chrome.

Step 5: Complete the Installation

Once you drag and drop the extension file, follow the steps that Google Chrome takes you through. Similarly, if the extension file is of .crx file format, you will be required to review the permissions and then add the extension.

Now, you can manage that added extension as you would like to with any other Chrome extension that you added through Chrome Webstore. Its icon will also appear in the Google Chrome Menu on the right side of the address bar once you activate it.

Method 2: Download Tracy extension for Chrome and install in Developer Mode

This is another method to install Tracy extension manually, but the twist is that here, you install by enabling the developer mode option provided in Google Chrome. This mode is commonly used for testing extensions or running unpublished tools.

Step 1: Download the Tracy extension file

Select and download the Tracy extension by clicking the 'Download CRX' button on the website.

Step 2: Extract the downloaded contents

Convert the file to a ZIP file if it is in CRX format then extract the Tracy extension zip file or folder that you downloaded. Make sure you extract it using the same folder name and keep it safely in another folder, so you don't delete it by mistake. The extracted folder will be needed to keep your Tracy extension running.

Step 3: Open Chrome Extension Setting Page

In the address bar of Google Chrome, type chrome://extensions and open the Chrome Extension Page.

Step 4: Enable Developer Mode

After opening the Chrome Extension page, look at the top right side, and you will find the toggle option of "Developer mode."Simply enable that developer mode option.

Step 5: Load the Unpacked Extension

Once you enable the developer mode option, you will see the menu of Load Unpacked, Pack Extensions and Update. From that, select the option "Load unpacked."

Step 6: Select the Extension Folder

Once the pop-up opens upon clicking Load unpacked, select the Tracy extension directory and click on the "Select Folder "button.

Step 7: Confirm and Install

After you select an extension folder of a Google Chrome extension you're installing manually, confirm its installation for the final time and let the installation complete.

Conclusion

Here we've made a step-by-step guide on How to manually install Tracy extension in 2 ways. We hope this guide proves helpful.

Similar Extensions

icon

Bishop Vulnerability Scanner Extension · Developer Tools 582 12 ★ 198KiB

icon

ZoomEye Tools Extension · Developer Tools 582 6 ★ 583KiB

icon

Display Access Keys Extension · Accessibility 582 3 ★ 6.56KiB

icon

Untrusted Types for DevTools Extension · Developer Tools 582 3 ★ 39.16KiB

icon

HackBar Extension · Developer Tools 582 52 ★ 1.56MiB

icon

CounterXSS Extension · Accessibility 582 3 ★ 98.96KiB

icon

Breakbot Extension · Developer Tools 582 5 ★ 141KiB

icon

Vulners Web Scanner Extension · Productivity 582 20 ★ 534KiB

icon

Input hidden Monitor Extension · Developer Tools 582 0 ★ 36.05KiB

icon

Plugin Vulnerabilities Extension · Developer Tools 582 1 ★ 9.98KiB

icon

Investigate with Lacework Extension · Productivity 582 0 ★ 17.45KiB

icon

should-i-trust Extension · Productivity 582 0 ★ 367KiB

icon

Cyber Web Tools Extension · Developer Tools 582 6 ★ 340KiB

icon

d3coder Extension · Developer Tools 582 37 ★ 108KiB

icon

OWASP Penetration Testing Kit Extension · Developer Tools 582 43 ★ 7.14MiB

icon

Shodan Extension · Productivity 582 136 ★ 27.6KiB

icon

YesWeHack VDP Finder Extension · Productivity 582 2 ★ 88.31KiB

icon

Hack-Tools Extension · Developer Tools 582 27 ★ 1.61MiB

icon

Scripter debugger extension Extension · Developer Tools 582 2 ★ 1.04MiB

icon

Pulsedive Threat Intelligence Extension · Productivity 582 30 ★ 18.48MiB

icon

retire.js Extension · Developer Tools 582 9 ★ 132KiB

icon

Hackers toolkit Extension · Developer Tools 582 25 ★ 211KiB

icon

IP, DNS & Security Tools | HackerTarget.com Extension · Developer Tools 582 31 ★ 94.76KiB

icon

XSS Extension · Developer Tools 582 6 ★ 232KiB

User reviews

icon

Mistah Mark (ID: 0000006b5d53133f) Voted 3 ★ - Updated 05/16/2021 Initial Review: ---------------- Installs cleanly, loads fine, however there is not comphrensive documentation (yet) to explain what exactly its doing to help pentest a site. Very cryptic desc. of its functions. I will report back once i learn some more but you should have a very firm handle on XSS before using this

icon

Emmanuel Odota (ID: 000000f76d538689) Voted 5 ★ - Updated 07/28/2019 Quite the tool to look for XSS...a must have tool