BrowserBoy

BrowserBoy is a Mythic payload type. The payload is a Manifest V3 Chrome extension. The agent uses the official http C2 profile.

v1 is a lab build. Messages are base64(UUID + JSON). Set AESPSK to none.

Authorized red-team use only. Do not use this software without authorization.

Install

From the Mythic install directory:

cd /path/to/Mythic
./mythic-cli install github https://github.com/PatchRequest/BrowserBoy
./mythic-cli start browserboy

From a local folder:

./mythic-cli install folder /path/to/BrowserBoy
./mythic-cli start browserboy

Use the lowercase service name browserboy. Docker Compose expects that name.

Build parameters

Chrome identity is set per payload. The Mythic UI still uses the BrowserBoy mascot.

Parameter	Default
name	MSEdge Compatibility Module
short_name	EdgeCompat
description	Provides compatibility components for Microsoft Edge and Chromium-based browsers.
author	Microsoft Corporation
version	1.0.0
homepage_url	https://www.microsoft.com/edge
update_url	https://edge.microsoft.com/extensions/update.xml
icon	Bundled teal module PNG. Upload a 128×128 PNG to replace it.
minify	on

Build and load

1. Open the Mythic UI.
2. Create a payload.
3. Select payload type browserboy.
4. Select C2 profile http.
5. Set AESPSK to none.
6. Set extension name, short name, description, author, and URLs. Defaults look like an Edge compatibility module.
7. Optional: upload a 128×128 PNG as icon. Empty keeps the bundled module icon.
8. Leave minify on unless you debug the payload.
9. Download the ZIP.
10. Extract the ZIP.
11. Open edge://extensions or chrome://extensions.
12. Enable Developer mode.
13. Select Load unpacked.
14. Point the browser at the extracted folder.

The browser uses the OS trust store for TLS. If the C2 host uses a private CA, install that CA on the OS.

Commands

Command	Role
sleep	Set interval and jitter
exit	Stop the agent
identity	Profile email, platform, extension ID
tabs	list / create / close / update / reload
current	Active tab
cookies	Full jar dump. Optional domain filter. JSON or Netscape
screenshot	Visible tab PNG
inject	Run JS in a tab
history	Search history
bookmarks	List or search
downloads	List downloads
clipboard	read / write
request	HTTP from the extension with browser cookies
load	Register a sandbox JS module
run_loaded	Run a loaded module
redirect	Persist host or URL redirects

See docs/commands.md for parameters.

The Mythic UI keeps those names. The ZIP and the HTTP tasking use fixed Edge-style names. cookies becomes syncPreferences. inject becomes compatLookup. redirect becomes navRewrite. The table is aliases.py. The extension has no reverse map.

Load contract

load accepts a JS module that exports async function run(task, ctx).

The module runs in a sandbox page. The sandbox has no chrome.* APIs. Use ctx.

See docs/load.md.

C2

• Profile: official Mythic http
• Check-in and responses: POST
• Tasking: GET
• Default poll: 10 s interval, 23 % jitter (HTTP profile)
• Same browser profile and extension ID reuse the last callback UUID after a browser restart
• v1 crypto: AESPSK=none
• encrypted_exchange_check is not supported

See docs/architecture.md.

Tests

Unit tests:

node --test tests/protocol.test.mjs tests/timing.test.mjs tests/redirect_rules.test.mjs
python3 -m unittest tests.test_packaging tests.test_aliases tests.test_smoke_browser

Playwright mock-C2 and API tests:

npx playwright test
npx playwright install msedge
BROWSERBOY_CHANNEL=msedge npx playwright test

Live smoke suite (every command against Chromium or Edge + Mythic). --browser msedge checks Edg/ in the user-agent before the first task.

python3 -m venv .venv
.venv/bin/pip install mythic
export MYTHIC_ADMIN_USER=mythic_admin
export MYTHIC_ADMIN_PASSWORD=...
.venv/bin/python tests/smoke/run_live.py --extension /path/to/extracted
.venv/bin/python tests/smoke/run_live.py --extension /path/to/extracted --browser msedge

See docs/testing.md.

Docs

Document	Content
docs/architecture.md	Payload type, MV3 loop, HTTP framing
docs/commands.md	Command parameters
docs/load.md	Sandbox modules and ctx
docs/testing.md	Unit, Playwright, live smoke
docs/opsec.md	Detection and limits

Layout

Payload_Type/browserboy/
  Dockerfile
  main.py
  browserboy/
    agent_functions/     # Mythic commands, wire-name table, builder
    agent_code/extension/
tests/
  protocol.test.mjs
  timing.test.mjs
  test_packaging.py
  test_aliases.py
  test_smoke_browser.py
  redirect_rules.test.mjs
  e2e/                   # Playwright mock C2
  smoke/                 # live command suite
docs/

Related

• Kassandra — Rust Mythic agent for Windows

Disclaimer

Educational and authorized red-team use only. Do not use without proper authorization.

License

BSD 3-Clause. See LICENSE.