Ad Vision - Free Ad Spy tool for Facebook

This Chrome extension named "Ad Vision - Free Ad Spy tool for Facebook" is designed to help users spy on Facebook ads, providing filtering, saving, and historical data features for Facebook Ad Library users.

Key Functionalities and Behaviors:

• UUID Generation and Storage: Generates and stores a unique UUID for the extension instance using crypto.getRandomValues and Chrome's local storage.

• Country and IP Detection: Fetches the user's country code and IP address from Cloudflare's speed test API and caches this information locally.

• Network Communication:

  • Establishes WebSocket connections to remote endpoints (e.g., https://api.ad-vision.click/api and other endpoints) for command and data exchange.
  • Uses fetch API extensively to communicate with Facebook's GraphQL API to retrieve ad data.
  • Implements a proxy WebSocket connection to relay requests and responses.
  • Handles HTTP request/response interception and modification using Chrome's webRequest API and declarativeNetRequest API to modify headers (e.g., Origin header).

• Data Handling:

  • Compresses and decompresses data using pako (zlib) library for efficient transmission.
  • Encodes and decodes data in base64 format.

• User Authentication:

  • Attempts to detect logged-in user information from Google and Facebook by making requests to their respective endpoints and storing tokens and user IDs in local storage.

• Ad Data Fetching:

  • Sends GraphQL queries to Facebook's API to fetch ads based on user-defined filters.
  • Parses and structures ad data including ad IDs, dates, page info, media, and other metadata.

• Extension Installation and Update Checks:

  • Periodically checks if the extension should perform an install routine.
  • Sends installation and uninstall events to a remote server.

• Background Message Handling:

  • Listens for messages from other extension parts to perform login, fetch ads, and execute scripts.

• No Obfuscation:

  • The code is minified but not obfuscated; variable names are short but meaningful, and no string encryption or control flow flattening is used.

Potentially Sensitive or Risky Behaviors:

• Extensive Network Communication: Communicates with external servers via WebSocket and HTTP, including sending compressed and encoded data.
• Intercepts and Modifies Web Requests: Uses Chrome's webRequest and declarativeNetRequest APIs to modify headers and track redirects.
• User Data Collection: Attempts to collect user identifiers and tokens from Google and Facebook.

Code Snippet Examples:

// WebSocket connection and message handling
this.con=new WebSocket(n);
this.con.onmessage=a=>this.onMessage(a.data);

// Fetching Facebook ads via GraphQL
const h=await(await fetch("https://www.facebook.com/api/graphql/?caller=ext",{method:"POST",body:o})).json();

// Storing user info in chrome.storage.local
chrome.storage.local.set({user:{userId:e.USER_ID,dtsgToken:a,provider:"facebook"}},()=>!0);

// Modifying request headers
await chrome.declarativeNetRequest.updateDynamicRules({addRules:[{id:s,priority:1,action:{type:"modifyHeaders",requestHeaders:[{operation:"set",header:"Origin",value:n}]},condition:{urlFilter:t+"*",resourceTypes:["xmlhttprequest"],initiatorDomains:[chrome.runtime.id]}}]});

Overall, the extension is designed to interact heavily with Facebook's ad data and external servers to provide its advertised functionality. It collects user-related tokens and modifies network requests to facilitate its operations. No direct evidence of shell command execution, PowerShell usage, Windows Registry operations, or persistence mechanisms beyond standard Chrome extension APIs was found.