Close Android Chrome Tabs – Now With Automation

I wanted a way to close Android Chrome tabs, and now I have it.

Close Android Chrome Tabs - Introduction

First of all, I wanted to wish everyone a Belated Happy Valentine's day!

If you read my last post about interacting with Android Chrome tabs, then you have an idea of where this one may be going.

First, I wanted to note that the code on that post was out-of-date, and I've provided the updates below (and updated the original post).

tabs = Array.from(document.querySelector('div /deep/ div /deep/ div /deep/ div /deep/ div /deep/ div /deep/ div.vbox.flex-auto').shadowRoot.querySelectorAll('.devices-view .device-page-list .vbox'), s => ({name: s.querySelector('.device-page-title').textContent, url: s.querySelector('.device-page-url .devtools-link').getAttribute('href')}))
str = '';
for (i = 0; i < tabs.length; i++){
    if (tabs[i].name != null){
      str += '- [' + tabs[i].name + '](' + tabs[i].url + ')\n'
    } else {
      console.log(tabs[i])
    }
}
copy(str)

That said, I received a great comment asking how to close these tabs as well.

After a lot of research and testing, I was finally able to figure this out. I'll walk through the manual process, as well as provide a short script to automate it at the end.

Pre-requisites

First, you will need ADB installed on your local system.

Once you have ADB installed and running, you can verify the connection after enabling USB debugging.

C:\Users\Ray>adb devices
* daemon not running; starting now at tcp:5037
* daemon started successfully
List of devices attached
70xxxxxxxxxxxx  unauthorized

Next, create a local port forwarding rule from a port to the chrome_devtools_remote on the target device.

C:\Users\Ray>adb forward tcp:9222 localabstract:chrome_devtools_remote
9222

Close Android Chrome Tabs - Research and Closing Tabs

During some of my searches, I came across this post that mentioned the port forwarding and the /json Chrome endpoints.

First, I went to http://localhost:9222/json/version to ensure that my forwarding worked.

Close Android Chrome Tabs - Version

With that working, I also went to the http://localhost:9222/json/list endpoint, to get a list of my tabs.

Close Android Chrome Tabs - List

Note that this is also another way to extract every tab from the device, as opposed to the DevTools and JavaScript method.

Closing the Tabs

The JSON endpoint was something that I was hoping to use to close my tabs, but couldn't get it working initially. For more information, I recommend the following posts that I spent some time on.

First, I picked one of my tabs that I wanted to close, and wrote down the id.

[ {
   "description": "",
   "devtoolsFrontendUrl": "http://chrome-devtools-frontend.appspot.com/serve_rev/@a9b97dff480d5c50843b5190c4d02373a0fc6d84/inspector.html?ws=localhost:9222/devtools/page/E49927F7E60C49875AF1E0A783ACD140",
   "id": "E49927F7E60C49875AF1E0A783ACD140",
   "title": "",
   "type": "other",
   "url": "",
   "webSocketDebuggerUrl": "ws://localhost:9222/devtools/page/E49927F7E60C49875AF1E0A783ACD140"
}, {
   "description": "",
   "devtoolsFrontendUrl": "http://chrome-devtools-frontend.appspot.com/serve_rev/@a9b97dff480d5c50843b5190c4d02373a0fc6d84/inspector.html?ws=localhost:9222/devtools/page/16025",
   "id": "16025",
   "title": "Should You Do Your Own Taxes? (and Why I Don’t) | Mr. Money Mustache",
   "type": "page",
   "url": "https://www.mrmoneymustache.com/2016/02/10/should-you-do-your-own-taxes/",
   "webSocketDebuggerUrl": "ws://localhost:9222/devtools/page/16025"
}, {

Next, I went to http://localhost:9222/json/close/16025, and received the message, "Target is closing". When I went back to my Android device, I saw that the tab was closed!

Automation

With manual closing verified, it was time to write a script to help Matt, and anyone else out.

You can find the code below, but it is obviously pretty simple.

import json
import requests

response = requests.get("http://localhost:9222/json/list")

#print(response.text.encode('utf-8'))

json_data = json.loads(response.text.encode('utf-8'))

for link in json_data:
    #print(link['id'])
    response = requests.get("http://localhost:9222/json/close/" + link['id'])
    print(response.text)

When I ran this script, it closed all 80 tabs that I had open quickly.

C:\Users\Ray\Documents\GitHub\SecurityTools\AndroidCloseTabs>python androidCloseTabs.py
Target is closing
Target is closing
Target is closing
Target is closing
...

As you can see, when I went back to my device, I had zero open tabs.

Close Android Chrome Tabs - Zero tabs

Finally, you can find the code and any updates in my GitHub repository

Close Android Chrome Tabs - Conclusion

This was a simple solution and script, but I'm glad that I finally got to answer the comment on my original post.

Let me know if you have any other useful tricks for people who abuse tabs like myself!

Con season is coming up, so hopefully I will have more CTF or general conference posts. I'm also still working through the eLearnSecurity XDS course, and I'm hoping to finish that up before Q2.

doyler on Githubdoyler on Twitter
doyler
Ray Doyle is an avid pentester/security enthusiast/beer connoisseur who has worked in IT for almost 16 years now. From building machines and the software on them, to breaking into them and tearing it all down; he's done it all. To show for it, he has obtained an OSCE, OSCP, eCPPT, GXPN, eWPT, eWPTX, SLAE, eMAPT, Security+, ICAgile CP, ITIL v3 Foundation, and even a sabermetrics certification!

He currently serves as a Senior Staff Adversarial Engineer for Avalara, and his previous position was a Principal Penetration Testing Consultant for Secureworks.

When he's not figuring out what cert to get next or side project to work on, he enjoys playing video games, traveling, and watching sports.

As an Amazon Associate I earn from qualifying purchases.

Common passed on this blog, I made it to a jam.

2 Comments

Filed under Security Not Included

2 Responses to Close Android Chrome Tabs – Now With Automation

Leave a Reply

Your email address will not be published. Required fields are marked *

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.