ShadowExplorerX

Executive Summary

When tracking threat actors, cybercrime syndicates, and APT staging operations, investigators frequently encounter exposed HTTP/HTTPS open directories (Index of /, Apache, Nginx, LiteSpeed, Python SimpleHTTPServer, and C2 drop points).

Visiting these directories in standard browsers poses severe operational security (OPSEC) and workstation security risks:

1. Accidental Execution: Browsers may trigger automatic downloads, script execution, or handler associations.
2. Telemetry Leakage: Unrestricted prefetching, referrer headers, and DNS leaks notify the adversary of your inspection.
3. Cluttered Workflow: Default directory listings lack search, file-type categorization, metadata analysis, and safe previewing.

ShadowExplorerX intercepts raw open directory responses and injects a zero-execution sandbox interface directly into the browser. It allows threat analysts to search, categorize, inspect metadata, and safely preview scripts, configs, and payloads in real time without a byte touching your local storage.

Core Capabilities

1. In-Browser Sandboxed Triage

• Zero Local Execution: Blocks automatic downloading, background requests, and script triggers.
• Isolated Document Sandbox: Sanitizes directory tables into a structured security console.
• Defanged Visuals: Safely renders malicious file names, hashes, and indicators.

2. High-Speed Regex & Hunt Engine

• Built-in in-browser search toolbar with instantaneous regular expression support.
• Support for .* (Regex Hunt), Aa (Case Sensitivity), and \b (Exact Word Boundaries).
• Fast keyboard navigation across hundreds of staged artifacts.

3. Syntax-Preserving File Preview Modal

• Safely read scripts (.py, .sh, .ps1, .bat, .vbs, .php, .jsp), configuration files (.conf, .ini, .yaml, .json), and memory dumps directly inside an in-browser code editor.
• In-editor regex search and highlight engine with instant match jumping.

4. Dual Tactical Themes (Dark / White Mode)

• Dark Tactical C2 Mode: Deep slate background (#0B0F17) engineered for long nocturnal threat hunting operations.
• Clean White Analyst Mode: Crisp high-contrast mode for reports and executive briefings.
• Instant toggle with zero layout flicker or page reloads.

Supported Environments

Installation & Deployment

Firefox (Recommended for Analysts)

1. Download the latest release: shadow-explorer-x-1.0.0-firefox.zip.
2. Open Firefox and navigate to about:debugging#/runtime/this-firefox.
3. Click Load Temporary Add-on… and select the downloaded zip file (or manifest inside the unzipped folder).
4. Browse to any exposed HTTP directory (or test on http://localhost:8080/) — the ShadowExplorerX sandbox will automatically activate!

Google Chrome / Chromium / Edge

1. Download shadow-explorer-x-1.0.0-chrome.zip and extract it to a directory.
2. Navigate to chrome://extensions/ in your browser.
3. Enable Developer mode in the top right corner.
4. Click Load unpacked and select the extracted folder.

Threat Hunter Playbook: C2 Directory Triage

# Example Triage Workflow on an exposed Cobalt Strike / WebShell stage:
# 1. Access target via Tor/VPN proxy: hxxp://101[.]42[.]255[.]92:8081/
# 2. ShadowExplorerX immediately takes over the DOM:
#    - Auto-detects server banner and file hierarchy
#    - Categorizes binaries (.exe, .elf), scripts (.ps1, .sh), and configs (.yaml, .json)
# 3. Press Ctrl+F / click Hunt Toolbar:
#    - Filter for payload extensions: \.(ps1|sh|bin|exe|dll)$
# 4. Click 'Inspect':
#    - Safely read the script in the sandbox editor without saving to disk
#    - Use the in-editor regex to identify C2 IP callbacks and API tokens

Integrity & Source Code

• GitHub Repository: xElessaway/ShadowExplorerX
• License: MIT
• Security Audit: AMO Add-on Linter verified with 0 errors. No remote script loading, strictly compliant with Firefox AMO & Chrome Web Store policies.