Offensive Callback (III): Inside the Browser Stealer — merch.js
Third post in the Offensive Callback series. This is the deep dive into the client-side JavaScript payload — what I call merch.js internally, served as dl.full.min.js by the XSS dealer. It’s the piece that runs in a victim’s browser and does all the actual collection work. The file is about 10,000 lines minified and bundles several libraries: a hashing lib..
Read moreOffensive Callback: Multi-Protocol Passive Intelligence Collection
So I’ve been sitting on this for a while. I’ve been working on a tool that I call Offensive Callback — a passive intelligence collection server that captures inbound traffic across HTTP(S), WebSocket, DNS, and ICMP simultaneously, enriching every hit with browser telemetry, geolocation, and automated OSINT. This post is about the server itself: what it ru..
Read more