[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6OeXwzbycmqLllGaJc0dsF2VWqFe8lUtutEMR3cTnWc":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"15a069c8-8e5c-4973-89af-8380f97257c1","WRAITH – Browser Hooking and Blind XSS Page Mirroring","wraith-browser-hooking-and-blind-xss-page-mirroring-0647af","WRAITH combines BeEF-style browser hooks with blind-XSS capture and a credentialed Page Mirror. Tested locally, with its limits examined.","WRAITH is a new browser-hooking framework that merges BeEF-like command channels with blind-XSS evidence collection and a credentialed page mirroring feature. It allows operators to deploy modules to hooked browsers, capture page content, and navigate authenticated pages using the browser's existing session.","WRAITH framework combines BeEF-style browser hooks with blind-XSS capture and page mirroring.","https:\u002F\u002Fwww.darknet.org.uk\u002F2026\u002F09\u002Fwraith-browser-hooking-and-blind-xss-page-mirroring\u002F","https:\u002F\u002Fwww.darknet.org.uk\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fwraith-browser-hooking-blind-xss-page-mirror.webp","2026-09-07T07:58:02+00:00","2026-09-07T08:00:13.475096+00:00",7,[17,20,22],{"name":18,"type":19},"WRAITH","product",{"name":21,"type":19},"BeEF",{"name":23,"type":19},"xsshunter-express","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":24,"icon":26,"name":27,"slug":28},null,"Tools","tools",[30,32,37],{"category":31},{"id":24,"icon":26,"name":27,"slug":28},{"category":33},{"id":34,"icon":26,"name":35,"slug":36},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":38},{"id":39,"icon":26,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,23],{"controls":45,"vendors":131},[46,75,104],{"slug":47,"name":48,"problem":49,"products":50},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":76,"name":77,"problem":78,"products":79},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":105,"name":106,"problem":107,"products":108},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[109,117,123],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":119,"url":121,"description":122},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":148},"wraith-framework-exploits-browser-sessions-for-silent-data-harvesting","WRAITH Framework Exploits Browser Sessions for Silent Data Harvesting","WRAITH demonstrates how browser-hooking attacks can silently hijack authenticated sessions, mirror private pages, and exfiltrate data without triggering traditional endpoint defenses. The root problem lies in a combination of insufficient Content Security Policies, lack of output encoding that enables blind XSS injection, and users or developers unknowingly loading malicious scripts into trusted browser contexts. Because WRAITH leverages the browser's existing authenticated session, stolen credentials are not required — making detection far harder. This matters because any web application accepting user-supplied input without proper sanitization becomes a potential delivery vector, putting internal tools, admin panels, and sensitive authenticated content at risk of silent exfiltration.",[137,138,139,140,141,142,143,144,145,146,147],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-53 SI-10: Information Input Validation","NIST SP 800-53 SC-18: Mobile Code","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-12: Audit Record Generation","OWASP Top 10 A03:2021 – Injection (XSS)","OWASP ASVS V5: Validation, Sanitization and Encoding","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing",{}]