Fransyfox 0xmoose מאת

Fransyfox watches postMessage traffic on every web page you visit. It detects postMessage listeners registered across all frames and origins, shows their source code and stack traces, captures cross-frame messages, and lets you filter, splice, and replay them.

Built for bug bounty hunters and client-side security researchers.

Features:

• Listener detection — monitors every postMessage listener registered via addEventListener/onmessage across all frames. Shows source code, stack traces, and frame hops. Unwraps wrappers (jQuery, Sentry, Raven, NewRelic, Rollbar, Bugsnag, Zone.js, Vue, React, and more).
• Message interception — captures window and MessagePort traffic with origin, source/target frame, payload, and timing.
• Findings engine — rule-based analysis flags risky listeners (innerHTML, eval, location.href, missing origin checks, etc.) ranked by severity.
• Match & Replace — live regex splicing of postMessage payloads in both directions. Intercept and rewrite messages as they fly.
• Composer — craft and send your own postMessage payloads into any frame.
• Map / Timeline — frame-tree graph and message timeline views.
• Filtering & blocking — block noisy or trusted listeners by code, URL, or regex.
• Deduplication — identical listeners from the same source are collapsed.
• Syntax highlighting & prettify — highlight.js with custom color rules and code beautify.
• Import/export — blocked lists, listeners, messages, and findings as JSON.
• External logging — forward detected listeners to your own endpoint.

Named in honor of Frans Rosén and his original postMessage-tracker. Spiritual successor to postMessage-tracker → FancyTracker → FransyTracker → Fransyfox.

Source code: https://github.com/GangGreenTemperTatum/Fransyfox
License: MIT