Chromium’s application mode makes it easy to create convincing desktop phishing applications. It allows the use of Chromium’s features to produce realistic-looking phishing pages that mimic genuine desktop applications.
Before delving into this article, I want to make it clear that this information is intended for educational purposes. It is for people who are passionate about learning cybersecurity and making the internet a safe and better place for everyone.
You may also like to read: Steal Windows Login Details Using Thief Raccoon
What is Chromium Application Mode
Chromium application mode allows websites to be launched in standalone windows that resemble a native desktop application. Chromium is based on such browsers these are Google Chrome and Microsoft Edge and the --app command line flag. The flag will launch a website in application mode which does several things:
- Create a new window for the site, separate from the main browser.
- The window is styled to resemble a native desktop, not a browser.
- The taskbar icon is customized to display the website’s favicon, not the browser’s.
- Launches the website in a compact window, sans address bar.
The given command below shows to launch Chrome or Microsoft Edge in application mode with the site being www.hackersking.in
#Google Chrome
C:\Program Files \Google\chrome\Application>Chrome.exe ---app = https://www.hackersking.in
#Mircofost Edge
C:\Program Files (x86)\Microsoft \Edge\Application>msedge.exe ---app= https://www.hackersking.in
The commands create the windows of our website homepage and the taskbar represents it by our website favicon.
Faking A Navigation Toolbar
With the address bar hidden in application mode, we need to manually create a mock address bar. I repurposed the address bar HTML/CSS from my BITB repo( its signature so avoid using it in real engagement).
#You can use a live website or local HTML files (C:\path\to\file.html)
#This example uses a local HTML file “index.html”.
C:\Program Files \Google\chrome\Application>chrome.exe ---app=C:\Users\testUser\Index.html
The taskbar will show the site icon, which I have replaced with Microsoft’s logo, so it will now display that instead.
Internal & External Phishing Attack
The Chromium application mode feature is compatible with multiple operating systems, including Mac0S, where this command was executed.
“/Application/Google Chrome.app/Contents/MacOS/Google Chrome” ---app=https://www.hackersking.in
The result is fine, but I did not match the font that’s something you should consider.
Controlling window JavaScript
The phishing site specified with the —app has some control over the window’s setting when it is launched.
Window. close( ) - closes the window. It is used to terminate the window after the user acts.
Window. resize TO(x,y) - The window resizes. it is used to resize the window or emulate the window size of the software you are impersonation.
Window.moveTo(x,y) - It positions the window. it used to place the window in a certain location on the screen.
Internal & External Phishing Attack
This technique is mainly for internal phishing, but it can also work for external phishing. You can share the fake apps as files. If you've created a phishing page with a fake address bar, just set the --app parameter to send users to your phishing site.
I hope this information is helpful for you, don't forget to save bookmarks and subscribe to us for future post updates like this.
We provide personal hacking live & pre-recorded classes in 1 to 1 mentorship. The new batch started every weekend. If you're passionate about learning more advanced hacking then give us a try and I promise it is worth your time.
.png)
