Chrome json plugin
Author: m | 2025-04-24
Github JSON Editor: A Chrome Plugin for Editing JSON Files on Github. Github JSON Editor is a free Chrome plugin developed by techierishi. It falls under the category of Browsers and is
Chrome Json Plugin: Json Explained - Bito
Jamf Nation Community Products Jamf Pro Google Chrome Pepper Flash Disabling Options Subscribe to RSS Feed Mark Topic as New Mark Topic as Read Float this Topic for Current User Bookmark Subscribe Mute Printer Friendly Page Hey guys we are embarking on removing Pepper Flash from Google Chrome and we have a few ideas however, before I reinvent the wheel I wanted to see what if any suggestions you guys have. All forum topics Previous Topic Next Topic 9 REPLIES 9 Hey Mr. Lee, what exactly are you trying to achieve? If it's disabling flash as a plugin, this is a good start, then look at Basically, I'd like to disable the Google built in Pepper Flash and use the standard Flash Plugin. Matt:You understand that this is not supported by Google and may not even work? That Chrome is a 32-bit app and the "standard" Flash Plugin is 64-bits on modern hardware? That the "standard" Flash Plugin is currently broken on some Mac hardware: Very interesting. Its a company policy so let me pass that info on. Thanks Greg! All that said, disabling the Pepper Flash Player and enabling the player in /Library/Internet Plugins using this technique: seems to work. Not sure how you'd do manage that on all your machines, however. Yeah thats the hiccup, its a JSON coded preference file. "its a JSON coded preference file"Which is editable. Plenty of JSON modules for various scripting languages. But you need to do it for every user at login, OverviewThe most beautiful and customizable JSON/JSONP highlighter that your eyes have ever seen. Open source at is a Chrome extension for printing JSON and JSONP.Notes:* This extension might crash with other JSON highlighters/formatters, you may need to disable them* To highlight local files and incognito tabs you have to manually enable these options on the extensions page* Sometimes when the plugin updates chrome leaves the old background process running and revokes some options, like the access to local files. When this happen just recheck the option that everything will work again* Works on local files (if you enable this in chrome://extensions)Features* Syntax highlighting* 27 built-in themes* Collapsible nodes* Clickable URLs (optional)* URL does not matter (the content is analysed to determine if its a JSON or not)* Inspect your json typing "json" in the console* Hot word `json-viewer` into omnibox (type `json-viewer` + TAB and paste your JSON into omnibox, hit ENTER and it will be highlighted)* Toggle button to view the raw/highlighted version* Works with numbers bigger than Number.MAX_VALUE* Option to show line numbers* Option to customize your theme* Option to customize the tab size* Option to configure a max JSON size to highlight* Option to collapse nodes from second level + Button to unfold all collapsed nodes* Option to include a header with timestamp + url* Option to allow the edition of the loaded JSON* Option to sort json by keys* Option for C-style braces and arrays* Scratch pad, a new area which you can type/paste JSON and format indefinitely using a button or key shortcut. To access type `json-viewer` + `TAB` + `scratch pad` ENTERThis plugin is open source and suggestions Pontes (@thiagopnts)@bluec0re@North101Ben Hollander (@benhollander)Mehdi Bahrami (@mehdibahraami)Reimund Trost (@reimund)Ben van Enckevort (@benvan)LicenseMIT LicenseAny questions tweet me @tuliosDetailsVersion0.18.1UpdatedDecember 23, 2020Offered bytuliosSize310KiBLanguagesDeveloperTulio OrnelasTulegatan 12, app 1101Stockholm 11353Sweden Email ornelas.tulio@gmail.comNon-traderThis developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.PrivacyThe developer has disclosed that it will not collect or use your data.This developer declares that your data isNot being sold toChrome Json Plugin - chat.pw.org
OverviewEncapsula los campos primitivos de un JSON en un objeto con clave 'value'.This plugin allows to transform JSONs to a valid JSON for a gRPC request using actuators and the other way around. 2, 2024Offered byAlexandre CurrásSize95.4KiBLanguagesDeveloper Email alex.curras1@gmail.comNon-traderThis developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.PrivacyThe developer has disclosed that it will not collect or use your data.This developer declares that your data isNot being sold to third parties, outside of the approved use casesNot being used or transferred for purposes that are unrelated to the item's core functionalityNot being used or transferred to determine creditworthiness or for lending purposesRelatedJSON Formatter5.0(2)Format JSON in textbox or read/format from fileForm AutoFiller0.0(0)Automatically fill form fields using a JSON objectJSON Crack Formatter5.0(2)Visualize your JSON data into graphs.JSON RPC Chrome Viewer5.0(17)JSON RPC requests Chrome developer tools viewer. More convenient way to manage your rpc requests.Virtual Json Viewer4.6(8)JSON browser extension with virtual DOM, search and JQ filteringJSON Formatter4.6(1.9K)Makes JSON easy to read. Open source.Web To JSON0.0(0)Take value from web and take json api updatedJSON Pretty4.9(7)Use JSON Pretty to parse, format, and pretty print json data. A powerful json formatter and beautify tool for easy data readability.JSON Beautifier and Editor4.8(39)Display JSON objects by transforming them into Syntax editable highlighted HTML to validate, format, and saveJSON Formatter5.0(1)Chrome extension to format JSONYouTube Comment Extractor5.0(2)Extract loaded YouTube comment to JSONJSON Response Viewer5.0(5)Simple JSON responses viewerJSON Formatter5.0(2)Format JSON in. Github JSON Editor: A Chrome Plugin for Editing JSON Files on Github. Github JSON Editor is a free Chrome plugin developed by techierishi. It falls under the category of Browsers and isjson viewer plugin ดูโครงสร้างไฟล์ json สุดเจ๋งบน google chrome
This report highlights a vulnerability in the Hunk Companion plugin This flaw poses a significant security risk, as it enables attackers to install vulnerable or closed plugins, which can then be exploited for attacks such as Remote Code Execution (RCE), SQL Injection, Cross‑Site Scripting (XSS), or even the creation of administrative backdoors. By leveraging these outdated or unmaintained plugins, attackers can bypass security measures, manipulate database records, execute malicious scripts, and gain unauthorized administrative access to the site.Method of ExploitationWhile tracing an infection on a WordPress site, we uncovered a live vulnerability currently being exploited in a two‑step process:Unauthenticated Installation/Activation: Attackers exploit a flaw to install and activate the now‑closed and vulnerable plugin, WP Query ConsoleRemote Code Execution (RCE): The vulnerability in WP Query Console is then exploited to evaluate arbitrary and malicious PHP code.In the infections we’ve analyzed, attackers use the RCE to write a PHP dropper to the site’s root directory. This dropper allows continued unauthenticated uploads via GET requests, enabling persistent backdoor access to the site.InvestigationThe vulnerability was uncovered during an investigation into the entry point for an infection caused by its exploitation. Access logs revealed that the change timestamp of a randomly named PHP file located in the root of the WordPress installation (/htdocs/aea74fff3c02.php) was preceded by requests to the following endpoints:Timerequest_urlhttp_user_agentrequest_typeNov 27, 2024 @ 08:21:41.812/aea74fff3c02.phpMozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2735.76 Safari/537.36GETNov 27, 2024 @ 08:21:41.561/?rest_route=/wqc/v1/queryMozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2735.76 Safari/537.36POSTNov 27, 2024 @ 08:21:40.354/wp-json/hc/v1/themehunk-importMozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2735.76 Safari/537.36POSTNov 27, 2024 @ 08:21:08.151/wp-json/hc/v1/themehunk-importMozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2735.76 Safari/537.36POSTFurther investigation revealed that the plugins responsible for these endpoints are Hunk Companion and WP Query Console, respectively. Each observed infection’s modification times aligned with POST requests to these Preview: 13.0 npmPackages: apollo-client: ^2.3.1 => 2.3.1 jest: ^22.2.1 => 22.2.1 ... react: ^16.3.2 => 16.3.2 react-apollo: ^2.1.4 => 2.1.4 run4staged: ^1.1.1 => 1.1.1 solidarity: 2.0.5 => 2.0.5 styled-components: ^3.1.6 => 3.1.6 npmGlobalPackages: create-react-app: 1.5.2 create-react-native-app: 1.0.0 envinfo: 5.10.0 exp: 49.2.2 gatsby-cli: 1.1.52 npm: 5.6.0 react-native-cli: 2.0.1 solidarity: 2.1.0 typescript: 2.8.1Programmatic UsageEnvinfo takes a configuration object and returns a Promise that resolves a string (optionally yaml, json or markdown)import envinfo from 'envinfo';envinfo.run( { System: ['OS', 'CPU'], Binaries: ['Node', 'Yarn', 'npm'], Browsers: ['Chrome', 'Firefox', 'Safari'], npmPackages: ['styled-components', 'babel-plugin-styled-components'], }, { json: true, showNotFound: true }).then(env => console.log(env));logs:{ "System": { "OS": "macOS High Sierra 10.13", "CPU": "x64 Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz" }, "Binaries": { "Node": { "version": "8.11.0", "path": "~/.nvm/versions/node/v8.11.0/bin/node" }, "Yarn": { "version": "1.5.1", "path": "~/.yarn/bin/yarn" }, "npm": { "version": "5.6.0", "path": "~/.nvm/versions/node/v8.11.0/bin/npm" } }, "Browsers": { "Chrome": { "version": "67.0.3396.62" }, "Firefox": { "version": "59.0.2" }, "Safari": { "version": "11.0" } }, "npmPackages": { "styled-components": { "wanted": "^3.2.1", "installed": "3.2.1" }, "babel-plugin-styled-components": "Not Found" }}All of envinfo's helpers are also exported for use. You can use envinfo as a whole, or just the parts that you need, like this:const envinfo = require('envinfo');// each helper returns a promiseconst node = await envinfo.helpers.getNodeInfo();// The promises resolve to an array of values: ["Name", "Version", "Path"]// e.g. ["Node", "10.9.0", "/usr/local/bin/node"]console.log(`Node: ${node[1]} - ${node[2]}`); // "Node: 10.9.0 - ~/.nvm/versions/node/v8.14.0/bin/node"CLI Options --system Print general system info such as OS, CPU, Memory and Shell --browsers Get version numbers of installed web browsers --SDKs Get platforms, build tools and SDKs of iOS and Android --IDEs Get version numbers of installed IDEs --languages Get version numbers of installed languages such as Java, Python, PHP, etc --binaries Get version numbers of node, npm, watchman, etc --npmPackages Get version numbers of locally installed npm packages - glob, string, or comma delimited list --npmGlobalPackages Get version numbers of globally installed npm packages --duplicates Mark duplicate npm packages inside parentheses eg. (2.1.4) --fullTree Traverse entire node_modules dependency tree, not just top level --markdown Print output in markdown format --json Print output in JSON format --console Print to console (defaults to on for CLI usage, off for programmatic usage)Integrationenvinfo is live in:React Native (react-native info)Create React App (create-react-app --info)Expo Environment Info (npx expo-env-info)Webpack (webpack-cli info)Solidarity (solidarity report)Gatsby (gatsby info)envinfo is used in the ISSUE_TEMPLATE of:styled-componentsJestApollo ClientAlternativestype command -v until you smash your computerscreenfetch - fetch system and terminal information, and display aJSON Formatter Chrome Plugin Extension - Web
In the previous chapter, I talked about how to store all fetched data in the Google sheet in your Google drive. You are not limited to your local computer or laptop to open the data. Or your partners can open it to work on projects anytime.When talking about digital and eCommerce projects, the Shopify project must be one of the most popular topics which many eCommerce sellers like to discuss. If you don’t believe me, please just check out the Shopify stock pricing and ask your surroundings how many sellers are significantly benefiting from Shopify. It’s all because of the easy-to-use and super agile features. The fragmented eCommerce era has come, and creating an online store is as easy as creating a blog.So in this Python Tutorial, I’ll walk you through how to create a Python script and scrape any Shopify website product data just by changing a website URL. By the end of this piece, you can learn how to find Shopify storefront API and read Shopify JSON, then write the python codes for specific product information, such as title, price, compared price, etc, as long as Shopify product data includes in the JSON format.Table of Contents: Build a Shopify Scraper to Fetch Competitor Webshop Product Data Using Easy2Digital APIsStorefront API & Shopify Product JSONImport Requests, JSON & create the variable with JSON methodSpecify product data and create Python for loopsSave the scraped data in Google Sheets via Easy2Digital APIUse Easy2Digital API – Shopify Product ScraperFull Python Script of Shopify Competitor Product Data ScraperFAQSHOPIFY Latest Trending API Endpoint RecommendationShopify Product JSON DataBasically, there are two types of Shopify products JSON API. One is storefront API: domainname.com/products.json which is open to any visitors, and the other is store admin API: domainname.myshopify.com/admin/products.json. For competitor monitoring, as you are not the store admin, so you can only leverage the open JSON API.As you can see, the product information listed on the website is shown here, however, compared with the admin API, the open API is only showing all visible product data feed on the website and excluding inactive SKUs. Also, it might be quite difficult to see in this JSON format, so you could install a browser plugin to prettify the format. Here I use chrome and install a JSON-formatted extension. The storefront API JSON product data would be prettified immediatelyImport JSON & Create A Variable with the JSON methodFirstly we wouldJSON Formatter Chrome Plugin Extension - Web Carpenter
Prettier-plugin-sort-jsonA plugin for Prettier that sorts JSON files by property name.DescriptionThis plugin adds a JSON preprocessor that will sort JSON files alphanumerically by key.By default, top-level object entries are sorted by key lexically using Array.sort, according to each character's Unicode code point value. It can be configured to sort recursively, and with a custom sort order.ExampleBefore:{ "z": null, "a": null, "0": null, "exampleNestedObject": { "z": null, "a": null }}After:{ "0": null, "a": null, "exampleNestedObject": { "z": null, "a": null }, "z": null}ExceptionsNon-objectsThis is meant to sort objects. JSON files with a top-level value that is not an object are skipped.JSON files with dedicated Prettier parsersThis will not sort package.json, package-lock.json, or composer.json. This plugin only affects the json parser used by Prettier. Prettier uses an alternate parser (json-stringify) for those three specific files (See here for details).JSON embedded in other filesThis will not sort JSON objects within other types of files, such as JavaScript or TypeScript files. This is just for sorting JSON files.RequirementsThis module requires an LTS Node version (v16.0.0+), and prettier v3+.We are maintaining support for Prettier v2 on version 2 of this plugin. See the main-v2 branch for instructions on using v2 of this plugin.InstallUsing npm:npm install --save-dev prettier-plugin-sort-jsonUsing pnpm:pnpm add --save-dev prettier-plugin-sort-jsonUsing yarn:yarn add --dev prettier-plugin-sort-jsonThen follow these instructions to load the plugin.There are some additional configuration options available (described below), but they are all optional.Example Prettier configuration{ "plugins": ["prettier-plugin-sort-json"]}ConfigurationThese configuration options are all optional. Each option can be set as a CLI flag, or as an entry in your Prettier configuraton (e.g. in your .prettierrc file).Here is an example .prettierrc file with all default options set:{ "plugins": ["prettier-plugin-sort-json"], "jsonRecursiveSort": false, "jsonSortOrder": "{"*": "lexical"}"}JSON Recursive SortSort JSON objects recursively, including all nested objects. This also sorts objects within JSON arrays.DefaultCLIConfigurationfalse--json-recursive-sortjsonRecursiveSort: JSON Sort OrderUse a custom sort order. This is specified as a JSON string that maps exact strings or regular expressions to sorting algorithms.DefaultCLIConfiguration""--json-sort-order ''jsonSortOrder: Here is an example JSON sort order string:'{ "placeThisFirst": null, "/^[^\\d+]/": "lexical", "/^\\d+/": "numeric" }'This sorts the key "placeThisFirst" ahead of all others. After that, the set of all keys that don't start with a number are sorted lexically. Lastly, the set of keys that start with a number are sorted numerically.Each jsonSortOrder key represents a literal key value or a category of keys, represented by a regular expression. Regular expressions are identified by leading and trailing forward slashes, along with some number of paths optionally following the trailing slash (supported flags are i, m, s, and u).Each jsonSortOrder value represents the sorting algorithm to use within that category. If the value is null, the default sorting algorithm lexical is used. Here are the supported sorting algorithms:Sorting AlgorithmDescriptionlexicalSort lexically (i.e. lexicographically). This is the default.numericFor keys that are prefixed with a number, sort by that number in ascending order. Otherwise sort lexically.reverseLexicalReverse-order lexical sort.reverseNumericReverse-order numeric sort.caseInsensitiveLexicalCase-insensitive lexical sort.caseInsensitiveNumericCase-insensitive numeric sort.caseInsensitiveReverseLexicalCase-insensitive reverse-order lexical sort.caseInsensitiveReverseNumericCase-insensitive reverse-order numeric sort.noneDo not sort.The order of the jsonSortOrder configuration determines how the keys in each category are. Github JSON Editor: A Chrome Plugin for Editing JSON Files on Github. Github JSON Editor is a free Chrome plugin developed by techierishi. It falls under the category of Browsers and isGoogle Chrome Plugin for JSON Reading - Super User
For desktop version 2.27 or later.SP Formatter4.2(5)Customize your SharePoint Column, View or Form Layout Formatting JSON using a full-featured editor instead of the default one.SP Editor4.8(52)Create and update SharePoint Online/SP2013/SP2016/SP2019 css/js files, inject files to web, manage web/list properties, list WebhookAutoReview for Power Automate5.0(2)Create Automated Review of Power Automate Cloud FlowsCisar4.9(27)SharePoint CSR Live EditSP Insider4.9(22)SP Insider (SPI) for Chrome is a free SharePoint Discovery tool for Developers and supports SharePoint Online/Office 365, 2016 and…SPShell - SharePoint: Login as Another4.5(6)This extension lets you login as another user to your SharePoint 2013/2016/Online Site with a button click.FlyView for SharePoint and Office 365 Sites4.7(69)Explore SharePoint sites with this super fast SharePoint navigation plugin, supports on-premise 2013/10/07 and Office 365 versionsMy Apps Secure Sign-in Extension2.2(138)My Apps Secure Sign-in ExtensionSPFX Workbench Manager5.0(2)Chrome Extension to manage your SharePoint workbench.Microsoft Power Automate (Legacy)2.0(63)Add-on for enabling web automation. This web extension is compatible with Power Automate for desktop version 2.26 or earlier.SPush SP editor4.0(3)Developer Tools extension to auto save script/css files to SharePoint.Microsoft Power Automate1.9(136)Add-on for enabling web automation. This web extension is compatible with Power Automate for desktop version 2.27 or later.SP Formatter4.2(5)Customize your SharePoint Column, View or Form Layout Formatting JSON using a full-featured editor instead of the default one.SP Editor4.8(52)Create and update SharePoint Online/SP2013/SP2016/SP2019 css/js files, inject files to web, manage web/list properties, list WebhookAutoReview for Power Automate5.0(2)Create Automated Review of Power Automate Cloud FlowsCisar4.9(27)SharePoint CSR Live EditSP Insider4.9(22)SP Insider (SPI) for Chrome is a free SharePoint Discovery tool for Developers and supports SharePoint Online/Office 365, 2016 and…Comments
Jamf Nation Community Products Jamf Pro Google Chrome Pepper Flash Disabling Options Subscribe to RSS Feed Mark Topic as New Mark Topic as Read Float this Topic for Current User Bookmark Subscribe Mute Printer Friendly Page Hey guys we are embarking on removing Pepper Flash from Google Chrome and we have a few ideas however, before I reinvent the wheel I wanted to see what if any suggestions you guys have. All forum topics Previous Topic Next Topic 9 REPLIES 9 Hey Mr. Lee, what exactly are you trying to achieve? If it's disabling flash as a plugin, this is a good start, then look at Basically, I'd like to disable the Google built in Pepper Flash and use the standard Flash Plugin. Matt:You understand that this is not supported by Google and may not even work? That Chrome is a 32-bit app and the "standard" Flash Plugin is 64-bits on modern hardware? That the "standard" Flash Plugin is currently broken on some Mac hardware: Very interesting. Its a company policy so let me pass that info on. Thanks Greg! All that said, disabling the Pepper Flash Player and enabling the player in /Library/Internet Plugins using this technique: seems to work. Not sure how you'd do manage that on all your machines, however. Yeah thats the hiccup, its a JSON coded preference file. "its a JSON coded preference file"Which is editable. Plenty of JSON modules for various scripting languages. But you need to do it for every user at login,
2025-03-29OverviewThe most beautiful and customizable JSON/JSONP highlighter that your eyes have ever seen. Open source at is a Chrome extension for printing JSON and JSONP.Notes:* This extension might crash with other JSON highlighters/formatters, you may need to disable them* To highlight local files and incognito tabs you have to manually enable these options on the extensions page* Sometimes when the plugin updates chrome leaves the old background process running and revokes some options, like the access to local files. When this happen just recheck the option that everything will work again* Works on local files (if you enable this in chrome://extensions)Features* Syntax highlighting* 27 built-in themes* Collapsible nodes* Clickable URLs (optional)* URL does not matter (the content is analysed to determine if its a JSON or not)* Inspect your json typing "json" in the console* Hot word `json-viewer` into omnibox (type `json-viewer` + TAB and paste your JSON into omnibox, hit ENTER and it will be highlighted)* Toggle button to view the raw/highlighted version* Works with numbers bigger than Number.MAX_VALUE* Option to show line numbers* Option to customize your theme* Option to customize the tab size* Option to configure a max JSON size to highlight* Option to collapse nodes from second level + Button to unfold all collapsed nodes* Option to include a header with timestamp + url* Option to allow the edition of the loaded JSON* Option to sort json by keys* Option for C-style braces and arrays* Scratch pad, a new area which you can type/paste JSON and format indefinitely using a button or key shortcut. To access type `json-viewer` + `TAB` + `scratch pad` ENTERThis plugin is open source and suggestions Pontes (@thiagopnts)@bluec0re@North101Ben Hollander (@benhollander)Mehdi Bahrami (@mehdibahraami)Reimund Trost (@reimund)Ben van Enckevort (@benvan)LicenseMIT LicenseAny questions tweet me @tuliosDetailsVersion0.18.1UpdatedDecember 23, 2020Offered bytuliosSize310KiBLanguagesDeveloperTulio OrnelasTulegatan 12, app 1101Stockholm 11353Sweden Email ornelas.tulio@gmail.comNon-traderThis developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.PrivacyThe developer has disclosed that it will not collect or use your data.This developer declares that your data isNot being sold to
2025-04-22OverviewEncapsula los campos primitivos de un JSON en un objeto con clave 'value'.This plugin allows to transform JSONs to a valid JSON for a gRPC request using actuators and the other way around. 2, 2024Offered byAlexandre CurrásSize95.4KiBLanguagesDeveloper Email alex.curras1@gmail.comNon-traderThis developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.PrivacyThe developer has disclosed that it will not collect or use your data.This developer declares that your data isNot being sold to third parties, outside of the approved use casesNot being used or transferred for purposes that are unrelated to the item's core functionalityNot being used or transferred to determine creditworthiness or for lending purposesRelatedJSON Formatter5.0(2)Format JSON in textbox or read/format from fileForm AutoFiller0.0(0)Automatically fill form fields using a JSON objectJSON Crack Formatter5.0(2)Visualize your JSON data into graphs.JSON RPC Chrome Viewer5.0(17)JSON RPC requests Chrome developer tools viewer. More convenient way to manage your rpc requests.Virtual Json Viewer4.6(8)JSON browser extension with virtual DOM, search and JQ filteringJSON Formatter4.6(1.9K)Makes JSON easy to read. Open source.Web To JSON0.0(0)Take value from web and take json api updatedJSON Pretty4.9(7)Use JSON Pretty to parse, format, and pretty print json data. A powerful json formatter and beautify tool for easy data readability.JSON Beautifier and Editor4.8(39)Display JSON objects by transforming them into Syntax editable highlighted HTML to validate, format, and saveJSON Formatter5.0(1)Chrome extension to format JSONYouTube Comment Extractor5.0(2)Extract loaded YouTube comment to JSONJSON Response Viewer5.0(5)Simple JSON responses viewerJSON Formatter5.0(2)Format JSON in
2025-04-10This report highlights a vulnerability in the Hunk Companion plugin This flaw poses a significant security risk, as it enables attackers to install vulnerable or closed plugins, which can then be exploited for attacks such as Remote Code Execution (RCE), SQL Injection, Cross‑Site Scripting (XSS), or even the creation of administrative backdoors. By leveraging these outdated or unmaintained plugins, attackers can bypass security measures, manipulate database records, execute malicious scripts, and gain unauthorized administrative access to the site.Method of ExploitationWhile tracing an infection on a WordPress site, we uncovered a live vulnerability currently being exploited in a two‑step process:Unauthenticated Installation/Activation: Attackers exploit a flaw to install and activate the now‑closed and vulnerable plugin, WP Query ConsoleRemote Code Execution (RCE): The vulnerability in WP Query Console is then exploited to evaluate arbitrary and malicious PHP code.In the infections we’ve analyzed, attackers use the RCE to write a PHP dropper to the site’s root directory. This dropper allows continued unauthenticated uploads via GET requests, enabling persistent backdoor access to the site.InvestigationThe vulnerability was uncovered during an investigation into the entry point for an infection caused by its exploitation. Access logs revealed that the change timestamp of a randomly named PHP file located in the root of the WordPress installation (/htdocs/aea74fff3c02.php) was preceded by requests to the following endpoints:Timerequest_urlhttp_user_agentrequest_typeNov 27, 2024 @ 08:21:41.812/aea74fff3c02.phpMozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2735.76 Safari/537.36GETNov 27, 2024 @ 08:21:41.561/?rest_route=/wqc/v1/queryMozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2735.76 Safari/537.36POSTNov 27, 2024 @ 08:21:40.354/wp-json/hc/v1/themehunk-importMozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2735.76 Safari/537.36POSTNov 27, 2024 @ 08:21:08.151/wp-json/hc/v1/themehunk-importMozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2735.76 Safari/537.36POSTFurther investigation revealed that the plugins responsible for these endpoints are Hunk Companion and WP Query Console, respectively. Each observed infection’s modification times aligned with POST requests to these
2025-04-22