Lion Cipher Lab
Characterize a browser hijacker: rogue extensions, proxy, homepage, and DNS changes
- Digital Forensics & IR (DFIR)
- Beginner
- ~45 min
- Free · no account required
Why it matters
A browser hijacker feels like a nuisance — your homepage changed, your searches go somewhere weird, ads appear where they shouldn't — so people uninstall the obvious extension and assume they're done. They are usually not done. Modern hijackers and the 'potentially unwanted programs' (PUPs) they ride in with make several changes at once, and the quiet ones are the dangerous ones: a system proxy or PAC file that funnels ALL of your browser traffic — including your bank and your webmail — through a machine the attacker controls, plus DNS changes that decide which server you actually reach when…
What you'll learn
- reading a rogue browser extension's manifest.json to judge its power (permissions, host_permissions, background service worker, content scripts)
- recognizing that an extension asking for <all_urls> host access can read and rewrite every page, cookie, and request
- spotting a homepage / default-search-provider hijack in a registry snapshot diff (Internet Explorer 'Start Page', Chrome/Edge policy keys)
- identifying the most dangerous change — a system proxy + PAC (AutoConfigURL) that silently routes ALL browser traffic through the attacker
- catching modified DNS: a rogue static NameServer and a poisoned hosts file that blackholes security vendors and redirects updates
- reading injected-ad and search-redirect network artifacts and tying them back to the extension and the proxy
- mapping the behavior to MITRE ATT&CK (T1176.001, T1112, T1090) and writing a complete remediation that reverts EVERY change, not just one
- judgment: telling a hijacker from adware from a legitimate corporate MitM proxy, and why removing only the extension leaves the machine compromised
Steps in this lab
- The scene: your homepage changed, but that's the least of it
- Artifact 1 — the rogue extension's manifest: how much power did it ask for?
- Artifact 1b — what the background script actually does
- Artifact 2 — the registry diff: homepage and default search hijacked
- Artifact 3 — the PROXY + PAC change: the dangerous one
- Artifact 4 — the DNS changes: rogue resolver + poisoned hosts file
- Artifact 5 — the network log: injection and redirection, live
- Pull the IOCs and map the behavior to MITRE ATT&CK
- The judgment call: hijacker vs adware vs a real MitM proxy, why <all_urls> is total, and how a pro remediates ALL of it
- What you can now do (and how to practice it safely)