# Phantom browser extension: collecting page intelligence for SRC hunting

> Phantom is a browser extension built for the page information gathering stage of SRC vulnerability hunting. It extracts APIs, domains, credentials and cloud keys from a page, then offers recursive scanning, batch API testing and export, with a five-minute silent period that trips up first-time users.

**Team-intN18-SoybeanSeclab/Phantom** — 一款面向SRC漏洞挖掘中，页面信息收集场景的浏览器扩展，自动收集页面及相关资源中的敏感信息与可疑线索，支持基础扫描、深度递归扫描、批量 API 测试及结果导出与自定义正则配置

- Repository: https://github.com/Team-intN18-SoybeanSeclab/Phantom
- Stars: 693 · Forks: 35
- Language: JavaScript
- License: Apache-2.0
- Published: 2026-10-21 · Updated: 2026-10-21 · Language: en
- Canonical page: https://hysenlabs.com/projects/team-intn18-soybeanseclab-phantom

## Phantom works inside the tab you are already authenticated to

The scope of this tool is narrow on purpose. Phantom is a browser extension for the information collection stage of SRC vulnerability hunting, so it runs in a normal browsing session against a page you have opened yourself. That design explains both its strength and its ceiling: it inherits the session cookies and headers of the browser, and it can only look at what a person visits.

The one-click basic scan pulls five groups of data out of the current page. API endpoints, split into absolute paths, relative paths and RESTful interfaces. Network resources such as URLs, domains, subdomains, ports and path parameters. File resources including JS, CSS, images and audio or video. Sensitive data such as email addresses, phone numbers, IP addresses, JWT tokens and authentication information. And security credentials, with AWS keys, GitHub tokens and generic API keys named explicitly in the feature list.

Results are bucketed under fixed keys so downstream work is predictable. The network group uses `absoluteApis`, `relativeApis`, `urls`, `domains`, `subdomains`, `jsFiles`, `cssFiles` and `images`. The credential group uses `emails`, `phoneNumbers`, `ipAddresses`, `jwts`, `awsKeys`, `githubTokens` and `credentials`. A third group holds `paths`, `parameters`, `ports`, `comments`, `companies` and `cryptoUsage`.

That fixed taxonomy is the part worth planning around. If your intake format expects other labels, the mapping happens after export rather than during the scan.

## Four modules separate extraction from scanning from testing

The README names four core modules, and the split explains how the extension behaves. `ContentExtractor` is the content extractor that identifies sensitive information on a page. `PatternExtractor` is the regular expression engine that applies both the built-in categories and any custom rules the user has written. `DeepScanner` is the depth scanner that handles recursive crawling. `ApiTester` is the API testing engine that verifies endpoints in bulk.

On the front end the project uses HTML5, CSS3 and JavaScript ES6+, and it integrates with the Chrome Extension API. Storage is split three ways: IndexedDB for local data, Chrome Storage for configuration, and an in-memory cache for scan performance.

The repository layout supports that split as well. `background.js` and `content.js` sit at the top level next to `manifest.json`, while `popup.html` holds the toolbar interface, `deepscan.html` the depth scanning view and `offscreen.html` with `offscreen.js` a separate document used for work that the main page cannot do. `src/`, `libs/` and `filters/` hold the source, bundled libraries and filter rules, and `testwin.html` is a dedicated test page.

What the README does not spell out is how requests are issued. A dedicated offscreen document is the standard way to reach the network from a service worker context, but the document never says which module performs fetches or how host permissions are declared, so treat those internals as unverified.

## Recursive scanning goes one to five levels deep with up to 32 parallel requests

The deep scanning mode is where Phantom does more than read one page. The documented bounds are concrete: recursion depth runs from 1 to 5 layers, and concurrency is configurable from 2 to 32 concurrent requests. Static files and invalid links are filtered out automatically, and results update live during the run rather than appearing at the end.

The tuning guidance in the README is worth taking literally. Maximum depth is suggested at 2 to 3 layers to avoid over-crawling, concurrency at 5 to 16 as a balance between speed and stability, and the timeout at 5 to 10 seconds. The scan scope can be narrowed to the same domain, subdomains or all domains, which is the setting that decides how wide the crawler roams once it leaves the page you started on.

Two operational notes follow from those numbers. A depth of 5 with 32 parallel requests against a large site is a lot of traffic aimed at a host that never agreed to be scanned, which is why the scope selector and the domain blacklist in settings carry real weight. And the concurrency ceiling is a limit on parallelism, not on total request count, so a deeper run multiplies the load on the target.

## ApiTester turns collected endpoints into batch requests you configure

The API testing tab works on the data the earlier scans produced. You pick a data category, configure the request parameters, and execute the batch. The engine supports GET and POST among other HTTP methods, previews response content, and reports status codes so a dead or unauthorized endpoint is visible without opening each URL by hand.

Request configuration can be adjusted enough to matter for authenticated targets. Cookie management pulls the current site's cookie automatically, arbitrary HTTP headers can be set, and authentication can be supplied as Bearer Token or Basic Auth. The documented header options live in the custom configuration area alongside the domain blacklist and filter conditions.

Batch testing is also the feature with the sharpest edge. It sends live traffic to endpoints discovered from a page, and some of those endpoints may not be meant to receive repeated requests. The README frames the tool as being for authorized testing within SRC and self-inspection scenarios, and states that users are responsible for their own use and that illegal use is prohibited. Nothing in the tool enforces a scope file or an allowlist, so the operator is the only control point.

## Loading the unpacked extension from a clone is the whole install

There is no package manager step and no build. The install is a clone, a browser extensions page, developer mode, and a directory picker. The clone command from the README is:

```bash
   git clone https://github.com/Team-intN18-SoybeanSeclab/Phantom.git
```

The next steps are the browser ones. Chrome users open chrome://extensions, Edge users open edge://extensions, both switch on developer mode, and then the load unpacked extension option is used to select the cloned project folder. From there the toolbar icon is the entry point to the whole interface.

A first basic scan is four actions: open the target page, click the extension icon, click the start scan button, and read the results. The deep scan adds a parameter step, since depth and concurrency are set on the deep scanning page before the run starts and results stream in a separate window. The API test path switches to the API testing page, selects a data category, sets the request parameters, and executes the batch.

The consequence of this install style is that you are running the default branch as shipped, with no version pinning. The default branch is master, and the releases are tagged separately, so tracking a stable tag requires extra work that the README does not describe.

## A five-minute silent window and other reasons a scan comes back empty

The troubleshooting section names three causes for a scan that returns little or nothing. The target may be a browser system page such as chrome:// or chrome-extension://, which the extension cannot read. The page may be inside a five-minute silent throttling period after the first scan. Or the custom rules may be too strict or broken.

The fixes are equally concrete: run the scan on an ordinary web page, press the start scan button manually to force it, and check the custom regular expressions in settings.

The second troubleshooting entry covers the deep scan failing to take effect, with three named causes: the target site requires authentication, the concurrency setting is high enough that requests fail, or the network timeout is set too short. The suggested corrections are to add the site's cookie in settings, lower concurrency to roughly 5 to 10, and raise the timeout to 10 seconds or more.

Browser lag has its own entry, and the advice points at the same knobs: reduce concurrency, reduce maximum depth, and turn off unneeded scan options. Taken together, the troubleshooting entries are really a description of which settings trade speed against reliability, and the ones to change first are concurrency and depth.

The export side has its own catch. Excel files may fail to open if you use a version that does not support the XML format, and encoding prompts are answered by choosing UTF-8 or by exporting JSON instead. That is a narrow compatibility issue, but it is the one that most often ends up in a bug report.

## Custom regex rules are the extension's main extension point

The custom configuration area lets you add your own regular expression rules, configure request headers and cookies, set a domain blacklist and filter conditions, and inject custom JavaScript. The two example rules in the README show the expected shape:

```javascript
const customApiRegex = /\/api\/v[0-9]+\/[a-zA-Z]+/g;
const customSensitiveRegex = /password[=:]\s*[\'"]?([^\'"\s]+)/gi;
```

The first matches versioned API paths, the second matches credential-looking assignments in page text. Both use the global flag, so a rule scans the whole input rather than stopping at the first hit, and the second is case-insensitive.

Two notes on scope. The `PatternExtractor` engine is where these rules plug in, so a broken rule affects extraction across the board rather than one category. And the script injection option is a double-edged feature: it lets you add site-specific extraction logic, but it also runs code in the page context, so the same rules about authorized use that apply to the request features apply here. The README does not describe a way to run the rules against a saved page offline, which means the extension is tied to a live browsing session.

For comparison, a scripted crawler that reads a saved HTML file and applies its own pattern library works offline, at scale, and with versioned rules in a repository. Phantom wins on session context and on how fast a person can go from a page to a list of endpoints; the script wins on repeatability and on handling many targets without a human in the loop.

## Conclusion

Use Phantom when you are working inside an authorized SRC program and you want page-level reconnaissance gathered in the browser you are already logged into, then verify the exported JSON or Excel file against the target's security policy before sending findings to a program. Skip it if you need unattended scanning at scale, if your engagement forbids injected JavaScript, or if you want a client library rather than a browser tool. Before the first deep scan, check the custom regex rules in settings, because an overly strict rule is the most common reason a scan returns almost nothing.

## FAQ

### How do I install the Phantom browser extension for SRC hunting?

Clone the repository, open chrome://extensions in Chrome or edge://extensions in Edge, enable developer mode, and use the load unpacked extension option to pick the cloned folder. There is no build step, and the toolbar icon is where you start a scan.

### Why does my Phantom scan return no results?

The README lists three causes: the target is a browser system page such as chrome:// or chrome-extension://, the page is inside the five-minute silent throttling period after the first scan, or the custom regular expressions are too strict or broken. Press the start scan button manually and check the custom rules in settings.

### What is the difference between Phantom's basic scan and deep scan?

The basic scan extracts APIs, domains, file resources, sensitive data and credentials from the page you are viewing. The deep scan recurses through discovered links from 1 to 5 levels with 2 to 32 concurrent requests, filtering static files and showing results live.

### Can Phantom export the results it finds?

Yes. The export feature supports JSON and Excel, and file names are generated automatically with the domain included. The README notes that Excel files need a version supporting the XML format, that encoding prompts should be answered with UTF-8, and that JSON export is a fallback if the file will not open.

### Does Phantom send the data it collects to a server?

The README states that all data is stored locally and is not uploaded to a server, with IndexedDB used for persistence and a one-click option to clear all scan data. Configuration is kept in Chrome Storage.

## Sources

- [Issues](https://github.com/Team-intN18-SoybeanSeclab/Phantom/issues)
- [License: Apache-2.0](https://github.com/Team-intN18-SoybeanSeclab/Phantom/blob/master/LICENSE)
- [README](https://github.com/Team-intN18-SoybeanSeclab/Phantom/blob/master/README.md)
- [Releases](https://github.com/Team-intN18-SoybeanSeclab/Phantom/releases)
- [Team-intN18-SoybeanSeclab/Phantom on GitHub](https://github.com/Team-intN18-SoybeanSeclab/Phantom)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/team-intn18-soybeanseclab-phantom