Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I'm building a browser for reverse engineers

nullpt.rs

Post reply on HN
Print view View original

1–10 of 58 posts

Re: Show HN: I'm building a browser for reverse engineers

#2

Post by tducret »

Very interesting, thanks!

For the fingerprinting part, can you explain the difference with the JShelter browser extension (https://jshelter.org/)?

I checked as you did in your demo video with https://demo.fingerprint.com/playground (using JShelter in Firefox). It produces a fingerprint detector report, like so :

{

    "fpd_evaluation_statistics": [
        {
            "title": "Navigator.prototype.plugins",
            "type": "resource",
            "resource": "get",
            "group": "BrowserProperties",
            "weight": 0,
            "accesses": 0
        },
        {
            "title": "MediaDevices.prototype.enumerateDevices",
            "type": "resource",
            "resource": "call",
            "group": "BrowserProperties",
            "weight": 1,
            "accesses": 2
        },
        [...]
}

However, it appears there is no way to display what was actually produced by the browser.

Was this the reason you had to build your own browser? Or is it possible to extend JShelter to do the same?

Re: Show HN: I'm building a browser for reverse engineers

#3

Post by nullpt_rs »

tducret wrote: post #2

Very interesting, thanks! For the fingerprinting part, can you explain the difference with the JShelter browser extension ( https://jshelter.org/ )? I checked as you did in your demo video with https://demo.fingerprint.com/playground (using JShelter in Firefox). It produces a fingerprint detector report, like so : { "fpd_evaluation_statistics": [ { "title": "Navigator.prototype.plugins", "type": "resource", "resource…

Ooh nice, I haven’t seen this project! I actually tried attempting this as an extension at first but wasn’t able to override page window functions. I’m curious to know how they accomplished this. (edit: I see that I missed the chrome.scripting API facepalm)

Thank you for sharing :)

FWIW I still think a custom browser approach has some benefits (stealth and executing in out of process iframes. could be wrong on the second part, haven’t actually tested!)

Re: Show HN: I'm building a browser for reverse engineers

#5

Post by tbrockman »

Not to comment on the rest of article or the author's goals, but it's absolutely possible to use a content script (dynamically injected into the `main` world, as opposed to the default `isolated`, for example: https://github.com/tbrockman/browser-extension-for-opentelem...) and Proxy's (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...) to hook (most? if not all) Javascript being executed in the webpage transparently.

Which for some functionality would have been a bit more portable and involved less effort.

Re: Show HN: I'm building a browser for reverse engineers

#6

Post by nullpt_rs »

tbrockman wrote: post #5

Not to comment on the rest of article or the author's goals, but it's absolutely possible to use a content script (dynamically injected into the `main` world, as opposed to the default `isolated`, for example: https://github.com/tbrockman/browser-extension-for-opentelem... ) and Proxy's ( https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... ) to hook (most? if not all) Javascript being executed in the webp…

Thanks for sharing some examples! Someone shared a similar project in the other thread. I didn’t realize this at the time of writing haha.

FWIW I still think modifying the browser has some positives wrt stealth and hooking out of process frames (could be wrong on the second part, haven’t actually tested!)

Still good to know though will leave a note in the article :-)

Re: Show HN: I'm building a browser for reverse engineers

#8

Post by tbrockman »

nullpt_rs wrote: post #6
tbrockman wrote: post #5

Not to comment on the rest of article or the author's goals, but it's absolutely possible to use a content script (dynamically injected into the `main` world, as opposed to the default `isolated`, for example: https://github.com/tbrockman/browser-extension-for-opentelem... ) and Proxy's ( https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... ) to hook (most? if not all) Javascript being executed in the webp…

Thanks for sharing some examples! Someone shared a similar project in the other thread. I didn’t realize this at the time of writing haha. FWIW I still think modifying the browser has some positives wrt stealth and hooking out of process frames (could be wrong on the second part, haven’t actually tested!) Still good to know though will leave a note in the article :-)

Yeah, there's a pretty overwhelming amount of browser APIs and functionality which isn't always (well-)documented to learn about. If I recall correctly Proxies wouldn't be detectable (seems to be supported by https://exploringjs.com/es6/ch_proxies.html#sec_detect-proxi...) so long as your injected content script runs first (otherwise other code could presumably override the Proxy constructor). You should also be able to hook any embedded frames by setting `target: { ..., allFrames: true }`.

Re: Show HN: I'm building a browser for reverse engineers

#9

Post by Retr0id »

tbrockman wrote: post #5

Not to comment on the rest of article or the author's goals, but it's absolutely possible to use a content script (dynamically injected into the `main` world, as opposed to the default `isolated`, for example: https://github.com/tbrockman/browser-extension-for-opentelem... ) and Proxy's ( https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... ) to hook (most? if not all) Javascript being executed in the webp…

I have a project (in my rather long project backlog) that involves hooking JS APIs to download youtube videos. I'm worried that if my extension (or a similar extension) gained enough popularity, youtube would start inspecting the relevant JS objects to see if they'd been replaced with proxy instances.

Aside from playing a hooking/patching game of cat and mouse, I don't think this is fully solvable without modifying the browser engine itself - then you can hook things in a way that's completely transparent to the JS in webpages.

Post reply on HN