[ new scan ] [ statistics ] [ github ] [ twitter ]

Proctor360

Version 4.12 View in Chrome Web Store

Last scanned: 27 days ago | force re-scan

Extension Details

Developer: https://proctor360.com/

Rating: 3.4 ★ (11 ratings)

Users: 30,000

Context-Aware Verdict

Security Analysis

CRITICAL

Overall Risk

Based on 8 total findings, ranked without considering overall context, including 6 high-risk and 2 medium-risk findings.

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: management

This extension has the management permission. Can manage other extensions. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
system.display
scripting
webRequest
activeTab
webNavigation
storage
management

Host Permissions:

http://*/*
https://*/*
<all_urls>

Embedded URLs (324 total):

https://prod1studentapi.proctor360.com/api	https://prod1studentapi.proctor360.com/api/exam-pass
https://proctor360.com/extension-uninstall	https://prod1student.proctor360.com/#/exam
https://prod1student.proctor360.com/#/exam/completed	https://proctor360.s3.us-east-1.amazonaws.com/general/Icon1.png
https://sbprod1student.proctor360.com/#/iframe-new/0JoBVLhDjGauzTuXbjsd	https://prod1student.proctor360.com
https://prod1.proctor360.com/#/exam	https://prod1student.proctor360.com/#/exam/early
https://prod1student.proctor360.com/128.png	https://pbs.twimg.com/profile_images/1322124113410957312/FEtybUCG_400x400.png
https://clients2.google.com/service/update2/crx	https://registry.npmjs.org/base64-js/-/base64-js-0.0.8.tgz
https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz	https://registry.npmjs.org/chrome/-/chrome-0.1.0.tgz
https://registry.npmjs.org/exeq/-/exeq-2.4.0.tgz	https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz
https://registry.npmjs.org/native-or-bluebird/-/native-or-bluebird-1.2.0.tgz	https://registry.npmjs.org/plist/-/plist-1.2.0.tgz
https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz	https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-4.0.0.tgz
https://registry.npmjs.org/xmldom/-/xmldom-0.1.31.tgz	https://secure.travis-ci.org/beatgammit/base64-js.png
http://travis-ci.org/beatgammit/base64-js	https://ci.testling.com/beatgammit/base64-js.png
https://ci.testling.com/beatgammit/base64-js	https://npmjs.org
http://bluebirdjs.com/docs/changelog.html	http://goo.gl/MqrFmX
http://goo.gl/rRqMUw	https://github.com/petkaantonov/bluebird
http://github.com/petkaantonov/bluebird/issues	http://github.com/petkaantonov/
http://promisesaplus.com/	http://promisesaplus.com/assets/logo-small.png
https://travis-ci.org/petkaantonov/bluebird.svg?branch=master	https://travis-ci.org/petkaantonov/bluebird
https://img.shields.io/badge/coverage-98%25-brightgreen.svg?style=flat	http://petkaantonov.github.io/bluebird/coverage/debug/index.html
http://stackoverflow.com/questions/tagged/bluebird	https://groups.google.com/forum/#
https://webchat.freenode.net/?channels=#promises	http://bluebirdjs.com/docs/getting-started.html
http://bluebirdjs.com/docs/api-reference.html	https://github.com/petkaantonov/bluebird/tree/2.x
https://github.com/petkaantonov/bluebird/issues	https://img.shields.io/npm/v/exeq.svg?style=flat
https://npmjs.org/package/exeq	https://img.shields.io/travis/afc163/exeq.svg?style=flat
https://travis-ci.org/afc163/exeq	https://img.shields.io/david/afc163/exeq.svg?style=flat
https://david-dm.org/afc163/exeq	http://img.shields.io/npm/dm/exeq.svg?style=flat
http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero	https://en.wikipedia.org/wiki/Symmetric_difference
https://en.wikipedia.org/wiki/Fisher-Yates_shuffle	http://peter.michaux.ca/articles/lazy-function-definition-pattern
http://drupalmotion.com/article/debounce-and-throttle-visual-explanation	http://ecma-international.org/ecma-262/6.0/#sec-properties-of-the-map-prototype-object
https://developer.mozilla.org/Web/JavaScript/Reference/Functions/rest_parameters	https://es5.github.io/#x15.3.4.3
https://developer.mozilla.org/Web/JavaScript/Reference/Operators/Spread_operator	https://lodash.com/
http://dojofoundation.org/	http://underscorejs.org/LICENSE
https://lodash.com/license	http://ecma-international.org/ecma-262/6.0/#sec-patterns
http://ecma-international.org/ecma-262/6.0/#sec-escaperegexppattern	https://en.wikipedia.org/wiki/Combining_Diacritical_Marks
http://ecma-international.org/ecma-262/6.0/#sec-template-literal-lexical-components	https://github.com/jashkenas/underscore/issues/1621
https://github.com/jashkenas/underscore/pull/1247	https://code.google.com/p/v8/issues/detail?id=90
https://es5.github.io/#x11.1.5	http://ecma-international.org/ecma-262/6.0/#sec-object.prototype.tostring
http://ecma-international.org/ecma-262/6.0/#sec-number.max_safe_integer	https://es5.github.io/#JO.
http://ecma-international.org/ecma-262/6.0/#sec-ecmascript-function-objects-call-thisargument-argumentslist	https://es5.github.io/#x13.2.2

Page 1 of 5

Raw Manifest

{
  "name": "Proctor360",
  "icons": {
    "32": "/assets/img/lock_32.png",
    "64": "/assets/img/lock_64.png",
    "128": "/assets/img/lock_128.png"
  },
  "action": {
    "default_icon": {
      "32": "/assets/img/lock_32.png",
      "64": "/assets/img/lock_64.png",
      "128": "/assets/img/lock_128.png"
    }
  },
  "version": "4.12",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Secure Testing Anywhere",
  "permissions": [
    "tabs",
    "system.display",
    "scripting",
    "webRequest",
    "activeTab",
    "webNavigation",
    "storage",
    "management"
  ],
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "matches": [
        "http://*/*",
        "https://*/*",
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*",
    "<all_urls>"
  ],
  "manifest_version": 3
}

Proctor360

Extension Details

Context-Aware Verdict

Security Analysis

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (324 total):

Raw Manifest

Secure Annex (beta)