Build a hijack from your own extension and find every place it persists

short · 45 min · Objective 3.3

Task

Create a browser hijack using an extension you write yourself, in the ways a real one persists -- extension, shortcut target, search provider, policy entry -- and then find and remove every instance. Nothing hostile is used; the persistence mechanisms are identical, which is what is being practised.

Steps

  1. Write a minimal browser extension of your own that changes the new tab page, load it unpacked in two browsers, and record it in lab/hijack/planted.csv with header mechanism,location,what_it_changes.
  2. Add three further persistence points of your own making: a modified browser shortcut target, a changed search provider, and a policy-installed extension entry. Add a row for each.
  3. Record the user-visible symptoms in lab/hijack/symptoms.csv with header symptom,which_mechanism_causes_it.
  4. Clear the browser cache and cookies, then record in lab/hijack/clearing.txt which symptoms survived -- which should be all of them.
  5. Find and remove every mechanism, recording where you looked in lab/hijack/removal.csv with header mechanism,where_found,how_removed,confirmed_gone.

Verify

awk -F, 'NR>1 && NF>=3 {n++} END {print n" mechanism(s) planted"}' lab/hijack/planted.csv
awk -F, 'NR>1 && NF>=2 {n++} END {print n" symptom(s)"}' lab/hijack/symptoms.csv
grep -Eic 'survived|unchanged|still' lab/hijack/clearing.txt
awk -F, 'NR>1 && $4 ~ /yes/ {n++} END {print n" mechanism(s) confirmed gone"}' lab/hijack/removal.csv
awk -F, 'NR>1 {print $2}' lab/hijack/removal.csv | sort -u | wc -l

Four mechanisms planted and all four confirmed gone, found in at least three distinct locations, and the clearing step showing that cache and cookies changed nothing. That last result is the whole lesson: clearing the cache does not touch any of this.

Notes

The modified shortcut is the one that makes a removal look like a failure. The hijack returns the moment the browser is launched from that icon, and the technician concludes the removal did not work.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.