# Payment Automation Suite - Browser Extension

🔧 **Advanced payment automation tools for authorized security testing**

## ⚠️ LEGAL DISCLAIMER

**THIS EXTENSION IS FOR AUTHORIZED SECURITY TESTING AND EDUCATIONAL PURPOSES ONLY**

Unauthorized use of this extension against payment systems, CAPTCHA services, or any protected systems without explicit written permission is:

- A violation of the **Computer Fraud and Abuse Act (CFAA)** in the United States
- A violation of similar cybercrime laws in other jurisdictions (GDPR, UK Computer Misuse Act, etc.)
- A breach of **Terms of Service** for payment gateways (Stripe, PayPal, Adyen, etc.) and CAPTCHA providers
- A violation of **PCI DSS compliance** requirements
- Potentially **criminal** activity subject to prosecution

**YOU MUST HAVE EXPLICIT AUTHORIZATION from the system owner before using this extension.**

The developers assume **NO LIABILITY** for misuse of this software.

---

## Features

This extension bundles 7 modules for payment system testing:

1. **Captcha Solver** - Automated CAPTCHA solving via API services
2. **hCaptcha Bypass** - Automated checkbox clicking and iframe injection
3. **3D Secure Handler** - Intercepts Stripe 3DS flows and modifies fingerprint data
4. **GOG Payment Handler** - Generates valid credit card numbers using Luhn algorithm
5. **Auto Fill** - Automated form filling with simulated human behavior
6. **Fetch Spy** - Payment gateway traffic monitoring and response analysis
7. **Payment Capture** - Extracts payment data from requests (localStorage only)

---

## Installation

### Chrome / Edge (Manifest V3)

1. Download or clone this repository
2. Open Chrome/Edge and navigate to `chrome://extensions/`
3. Enable **Developer mode** (toggle in top-right corner)
4. Click **"Load unpacked"**
5. Select the `extension/` directory
6. The extension icon should appear in your toolbar

### Firefox (Manifest V2)

1. Download or clone this repository
2. Open Firefox and navigate to `about:debugging#/runtime/this-firefox`
3. Click **"Load Temporary Add-on..."**
4. Navigate to the `extension/` directory
5. Select the `manifest_v2.json` file
6. The extension will be loaded temporarily (removed on browser restart)

**Note:** For permanent Firefox installation, you need to sign the extension via AMO (Mozilla Add-ons).

---

## Usage

### Quick Start

1. Click the extension icon in your toolbar
2. Toggle the **Master Control** switch to enable all modules
3. Individual modules can be toggled on/off as needed
4. Click **"Advanced Settings"** to configure API keys and module parameters

### Configuration

Open the **Options page** (⚙️ Advanced Settings) to:

- **API Keys Tab**: Configure CAPTCHA solving services (CapSolver, 2Captcha, etc.)
- **Module Config Tab**: Fine-tune delays, BIN lists, and behavior settings
- **Data Management Tab**: View statistics, export captured data (JSON/CSV), clear storage
- **About Tab**: Legal information and version details

### Module Details

#### 1. Captcha Solver
- Detects hCaptcha, Turnstile, and reCAPTCHA on pages
- Attempts click simulation first
- Falls back to API solving if configured
- Supports CapSolver, 2Captcha, NopeCHA, NoCaptchaAI

#### 2. hCaptcha Bypass
- Intercepts hCaptcha HTML via Fetch/XHR hooks
- Injects auto-click scripts into iframes
- Simulates human mouse movement

#### 3. 3D Secure Handler
- Monitors Stripe 3DS verification requests
- Removes browser fingerprint fields from payloads
- Attempts to force frictionless flow

#### 4. GOG Payment Handler
- Generates valid credit card numbers using Luhn checksum
- Rotates through configurable BIN prefixes
- Saves generated cards to localStorage

#### 5. Auto Fill
- Scans pages for payment forms
- Fills card data and billing addresses
- Simulates realistic typing speed and events
- Bypasses React/Vue state management

#### 6. Fetch Spy
- Logs all Fetch/XHR requests to payment gateways
- Parses responses for payment status
- Broadcasts events to other modules

#### 7. Payment Capture
- Monitors network requests for card data
- Tracks input fields in real-time
- Validates card numbers with Luhn algorithm
- Stores data in localStorage (no external exfiltration)

---

## Permissions

This extension requires the following permissions:

- `storage` - To save configuration and captured data
- `activeTab` - To inject content scripts into active tabs
- `webRequest` - To monitor network traffic (not blocking in V3)
- `host_permissions: *://*/*` - To run on all websites

---

## Distribution Restrictions

**This extension CANNOT be published to:**
- Chrome Web Store (violates policy 4.4: Illegal Activities)
- Firefox Add-ons (violates policy 2.2: Security Vulnerabilities)
- Edge Add-ons (violates Microsoft Store Policies)

**Manual installation only.** Users must enable Developer Mode and load the extension unpacked.

---

## Legitimate Use Cases

This extension is designed for:

✅ **Authorized penetration testing engagements** with written contracts
✅ **Bug bounty programs** where automated testing is explicitly allowed
✅ **Security research** on systems you own or have permission to test
✅ **Development/testing environments** under your control
✅ **Educational demonstrations** of payment security vulnerabilities

---

## Technical Notes

### Architecture

```
extension/
├── manifest.json (V3)          # Chrome/Edge manifest
├── manifest_v2.json            # Firefox fallback
├── background/
│   └── background.js           # Service worker / background script
├── content/
│   ├── content.js              # Module loader
│   └── modules/                # 7 module files with extension wrappers
├── ui/
│   ├── popup/                  # Quick control interface
│   └── options/                # Full configuration page
└── assets/icons/               # Extension icons
```

### Module Injection

- Content script (`content.js`) injects into `<all_urls>` at `document_start`
- Modules are dynamically loaded based on user configuration
- Each module runs in page context to access `window.fetch` and `XMLHttpRequest`
- Communication via `postMessage` and `chrome.runtime.sendMessage`

### Storage

- **chrome.storage.sync**: Configuration and settings (synced across devices)
- **chrome.storage.local**: Statistics and captured data (local only)
- **localStorage**: Used by modules for temporary data

---

## Troubleshooting

### Modules not loading
1. Check that Master Control is enabled in popup
2. Open DevTools Console and look for `[ContentScript]` logs
3. Verify module toggles are enabled
4. Reload the target page

### API solving not working
1. Verify API key is entered in Options > API Keys tab
2. Check that "Use API Fallback" is enabled in module config
3. Ensure you have sufficient API credits
4. Check background service worker logs for errors

### Extension not appearing
1. Confirm you're in Developer Mode (Chrome/Edge)
2. Check for manifest errors in `chrome://extensions/`
3. Try removing and re-adding the extension

---

## Development

### Building from Source

```bash
git clone <repository>
cd passerdone
```

The `extension/` directory is ready to load. No build process required.

### Modifying Modules

1. Edit files in `extension/content/modules/`
2. Each module has an extension wrapper at the bottom
3. Reload the extension in `chrome://extensions/`
4. Hard refresh the target page (Ctrl+Shift+R)

### Testing

1. Enable Debug Mode in Options > Module Config
2. Open DevTools Console (F12)
3. Look for logs prefixed with `[ModuleName]`
4. Monitor Network tab for intercepted requests

---

## Version History

### v1.0.0 (2025-01-10)
- Initial release
- 7 modules with full functionality
- Manifest V3 support (Chrome/Edge)
- Manifest V2 fallback (Firefox)
- Popup and Options UI
- Data export (JSON/CSV)

---

## Credits

**Authors:** LO & ENI
**Purpose:** Authorized security testing and education
**License:** For authorized testing only - No redistribution without permission

---

## Support

**This is not a commercial product.** No support is provided.

For authorized security testing engagements, ensure you have:
- Written permission from the system owner
- A defined scope of testing
- A responsible disclosure policy
- Proper authorization documentation

**Use responsibly. Stay legal. Get permission.**

---

## Final Warning

🚨 **Unauthorized use of this extension against live payment systems is illegal and unethical.**

Payment fraud and unauthorized access to computer systems can result in:
- Criminal charges
- Prison sentences
- Heavy fines
- Civil lawsuits
- Permanent criminal record

**Do not use this extension without explicit authorization.**

---

© 2025 Payment Automation Suite - For Educational and Authorized Testing Purposes Only