ChromSploit Framework v3.0

Overview

ChromSploit Framework is a cutting-edge educational security research tool designed for cybersecurity professionals, researchers, and students. Built with a modular architecture, it provides a comprehensive platform for studying browser vulnerabilities and exploitation techniques in controlled environments.

IMPORTANT: This framework is intended exclusively for educational purposes and authorized security testing. Unauthorized use is strictly prohibited and may violate applicable laws.

Key Highlights

• Intelligent Browser Detection: Automatic browser identification and exploit recommendations
• Analytics Dashboard: Real-time monitoring and performance metrics
• Performance Optimization: Advanced caching system for faster execution
• Enhanced Safety: Multi-level authorization and target validation
• Automated Testing: Browser test automation with Selenium/Playwright
• Multi-Exploit Chains: Automated combination of multiple CVEs
• Advanced Obfuscation: EXTREME-level payload obfuscation with 9+ techniques
• Auto-Ngrok Integration: Automatic tunnel creation for seamless exploitation
• Professional Reporting: Comprehensive PDF/HTML/JSON reports

Features

Quick Start

Prerequisites

• Python 3.9+ with pip
• Git for repository operations
• Virtual Environment (recommended)
• Administrative privileges (for some features)

Installation

# 1. Clone the repository
git clone https://github.com/Leviticus-Triage/ChromSploit-Framework.git
cd ChromSploit-Framework

# 2. Create virtual environment
python3 -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate

# 3. Install dependencies
pip install -r requirements.txt

# 4. Launch ChromSploit
python chromsploit.py

First Run

# Safe mode (recommended for first run)
python chromsploit.py --simulation safe

# With debug output
python chromsploit.py --debug

# Environment check
python chromsploit.py --check

CVE Exploit Arsenal

New in v3.0: Intelligent Features

Browser Detection & Auto-Selection

Automatically detect browser type and version from User-Agent strings and recommend compatible exploits:

from modules.detection import get_browser_detector

detector = get_browser_detector()
browser_info = detector.detect_browser(user_agent)
recommendations = detector.recommend_exploit(browser_info)

Features:

• Supports Chrome, Edge, Firefox, Brave, Vivaldi, Opera, Safari
• Version parsing and compatibility checking
• Intelligent exploit recommendations based on browser version
• Compatibility matrix for all CVEs

Monitoring & Analytics Dashboard

Real-time tracking and analytics for exploit execution:

• Success Rate Tracking: Per-CVE success rate calculation
• Performance Metrics: Execution time and performance statistics
• Browser Distribution: Analytics on target browser distribution
• Historical Data: Last 1000 exploit attempts tracked
• Report Export: JSON report generation

Access via: Main Menu → Analytics Dashboard

Caching System

Advanced caching for improved performance:

• Payload Caching: Automatic caching of generated payloads
• Obfuscation Caching: Cache obfuscation results
• Browser Detection Caching: 24-hour TTL for detection results
• Persistent Storage: JSON-based persistent cache
• LRU Eviction: Automatic cache management

Enhanced Safety & Authorization

Multi-level safety controls:

• Exploit Authorization: Per-user/exploit authorization system
• Target Validation: Localhost checks and production warnings
• Sandbox Mode: Default safe mode for testing
• Safety Levels: SAFE, RESTRICTED, STANDARD, UNRESTRICTED
• Audit Logging: Comprehensive action tracking

Browser Test Automation

Automated browser testing with Selenium/Playwright:

• Multi-Browser Testing: Test exploits across different browsers
• Automated Validation: Verify exploit execution
• Test Reports: Detailed test results
• Screenshot Support: Visual verification

Browser Multi-Exploit Chain

The flagship feature that automates exploitation of multiple browser CVEs in sequence:

graph LR
 A[CVE-2025-4664<br/>Reconnaissance] --> B[CVE-2025-2857<br/>OAuth Theft]
 B --> C[CVE-2025-30397<br/>WebAssembly JIT]
 C --> D[CVE-2025-2783<br/>Sandbox Escape]
 
 style A fill:#e1f5fe
 style B fill:#f3e5f5
 style C fill:#fff3e0
 style D fill:#ffebee

Enhanced Features

• Extreme Obfuscation: Control flow flattening, string encryption, anti-debugging
• Auto-Ngrok: Automatic tunnel creation for all callbacks
• Parallel Execution: Multi-threaded exploitation for speed
• Stealth Mode: Low-profile exploitation with evasion
• Intelligent Selection: Browser detection-based chain selection

Architecture

ChromSploit Framework v3.0
├── Core Engine
│ ├── Enhanced Menu System
│ ├── Module Loader
│ ├── Exploit Chain Manager
│ ├── Error Handler
│ └── Safety Manager
├── Detection & Analytics
│ ├── Browser Detector
│ ├── Exploit Monitor
│ └── Analytics Dashboard
├── Performance & Caching
│ ├── Exploit Cache
│ └── Cache Manager
├── Exploit Modules
│ ├── Browser CVEs (7)
│ ├── Server CVEs (2)
│ └── Custom Exploits
├── Obfuscation Engine
│ ├── JavaScript Obfuscation
│ ├── Binary Data Encryption
│ ├── Control Flow Flattening
│ └── Anti-Analysis
├── Testing Framework
│ ├── Browser Test Automation
│ ├── Selenium Integration
│ └── Playwright Integration
├── Network Integration
│ ├── Ngrok Manager
│ ├── HTTP Servers
│ └── WebSocket Handlers
└── Reporting System
 ├── PDF Generation
 ├── HTML Reports
 └── JSON Export

Design Patterns

• Modular Architecture: Plugin-based system for easy extension
• Safety-First: Simulation modes prevent accidental exploitation
• Enhanced Logging: Structured logging with analysis capabilities
• Chain Management: Dependency resolution and state sharing
• Professional UI: Color-coded menus with keyboard shortcuts
• Intelligent Detection: Automatic browser and vulnerability detection
• Performance Optimized: Caching and async operations

Documentation

Testing

# Run all tests
python -m pytest

# With coverage report
python -m pytest --cov=core --cov=modules --cov-report=html

# Test new improvements
python -m pytest tests/test_improvements.py -v

# Test new exploits
python -m pytest tests/test_new_exploits.py -v

# Validation framework
python -m core.validation_framework

Test Coverage: 95%+ across core modules

What's New in v3.0

Contributing

We welcome contributions from the security research community!

Please read our Contributing Guide for detailed information.

Security & Ethics

Responsible Use

This framework is designed for:

• Educational purposes and learning
• Authorized penetration testing
• Security research in controlled environments
• Bug bounty programs with proper authorization

Prohibited Uses

• Unauthorized access to systems or networks
• Malicious attacks on third-party systems
• Commercial exploitation without permission
• Distribution of malware or harmful content

Safety Features

• Simulation Modes: Safe testing without real exploitation
• Sandbox Mode: Default safe mode enabled
• Multi-Level Authorization: Per-exploit authorization required
• Target Validation: Automatic checks for localhost/production
• Audit Logging: Complete action tracking
• Confirmation Prompts: For dangerous operations
• Educational Flags: Clear marking of all educational content

License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

Summary

• Commercial use allowed (with restrictions)
• Modification and distribution permitted
• Patent use granted
• Must include license and copyright notice
• No warranty provided

Acknowledgments

Support & Contact