Advanced Phishing & Social Engineering Framework with MITM Proxy, Credential Harvesting, Session Hijacking, and Browser-Based Tracking.
Storm Breaker clones a target web page and injects capture modules (camera, microphone, geolocation, device-info, form credentials) that run in the visitor's browser, collecting data back to the operator's panel.
This is a lab tool for authorized security testing. Use responsibly and within legal boundaries.
- Page Cloning — Headless Chrome rendering with cURL fallback; strips original scripts, injects payloads, resolves assets via
<base href> - MITM Proxy — transparent reverse proxy that relays requests to the real target, rewrites all URLs, and patches fetch/XHR/WebSocket/history so the entire session stays routed through the operator
- Credential Sniffing — smart extraction from POST bodies: form-urlencoded, multipart, JSON, GraphQL, Livewire RPC, Inertia.js, and nested structures
- Credential Verification — auto-detects login success or failure from HTTP status codes, redirects, JSON responses, and HTML re-renders
- Session Hijacking — snapshots the victim's cookie jar on verified login and exports Cookie-Editor JSON for instant session replay
- Camera Capture — periodic snapshots from the visitor's webcam with proper cleanup on revoke/pagehide
- Microphone Recording — audio clip capture from the visitor's mic
- Geolocation Tracking — GPS location pings with coordinates and accuracy
- Device Fingerprinting — browser, OS, screen, and hardware info (always on)
- Custom JS Injection — inject your own JavaScript into cloned pages; runs after all built-in payloads with access to the Storm Breaker runtime API
- Homograph Domain Generator — 9 confusion categories: Cyrillic, Armenian, Greek, mixed-script, diacritics, digit swap, bigram swap, edit distance, and TLD swap with RDAP availability check
- Real-time SSE Stream — Server-Sent Events push for live credential and session notifications