Fransyfox — 0xmoose

Fransyfox watches postMessage traffic on every web page you visit. It detects postMessage listeners registered across all frames and origins, shows their source code and stack traces, captures cross-frame messages, and lets you filter, splice, and replay them.

Built for bug bounty hunters and client-side security researchers.

Features:

• Listener detection — monitors every postMessage listener registered via addEventListener/onmessage across all frames. Shows source code, stack traces, and frame hops. Unwraps wrappers (jQuery, Sentry, Raven, NewRelic, Rollbar, Bugsnag, Zone.js, Vue, React, and more).
• Message interception — captures window and MessagePort traffic with origin, source/target frame, payload, and timing.
• Findings engine — rule-based analysis flags risky listeners (innerHTML, eval, location.href, missing origin checks, etc.) ranked by severity.
• Match & Replace — live regex splicing of postMessage payloads in both directions. Intercept and rewrite messages as they fly.
• Composer — craft and send your own postMessage payloads into any frame.
• Map / Timeline — frame-tree graph and message timeline views.
• Filtering & blocking — block noisy or trusted listeners by code, URL, or regex.
• Deduplication — identical listeners from the same source are collapsed.
• Syntax highlighting & prettify — highlight.js with custom color rules and code beautify.
• Import/export — blocked lists, listeners, messages, and findings as JSON.
• External logging — forward detected listeners to your own endpoint.

Named in honor of Frans Rosén and his original postMessage-tracker. Spiritual successor to postMessage-tracker → FancyTracker → FransyTracker → Fransyfox.

Source code: https://github.com/GangGreenTemperTatum/Fransyfox
License: MIT