Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox and IE's "View source" can be spoofed to show anything

scriptjunkie.us

Post reply on HN
Print view View original

31–40 of 43 posts

Re: Firefox and IE's "View source" can be spoofed to show anything

#31

Post by code_duck »

there wrote: post #27
code_duck wrote: post #4

Thankfully, curl can't be tricked in such a manner. I'd have a more substantial comment, I hope, if the site was loading.

Thankfully, curl can't be tricked in such a manner. fetch http://jcs.org/tmp/nothing.html through curl: jcs@air:~> curl -s http://jcs.org/tmp/nothing.html there is really nothing here, i can promise you that. but you just aren't seeing the content. jcs@air:~> curl -s http://jcs.org/tmp/nothing.html | vis View source in Firefox. \^H\^H\^H\^H\^H\^H\^H\^H\^H\^H\^H[...]

Clever and true... I didn't say I'd view it in the terminal, though!

    curl http://jcs.org/tmp/nothing.html | vim -

Re: Firefox and IE's "View source" can be spoofed to show anything

#32

Post by code_duck »

dave1010uk wrote: post #11
code_duck wrote: post #4

Thankfully, curl can't be tricked in such a manner. I'd have a more substantial comment, I hope, if the site was loading.

Depending on how well your terminal deals with things like high unicode characters and RTL, I wonder if you could trick curl. You could also send the curl user agent harmless HTML and send Firefox / IE user agents a nasty exploit - that would probably fool me for a while.

You don't have to view the output in a terminal, though - generally I wouldn't if I was really trying to look at a file.

Server side user agent discrimination is a good point. One has have the option to send his or her own lies regarding that, though. There's always a a way to follow whatever script path to its various ends...

Re: Firefox and IE's "View source" can be spoofed to show anything

#33

Post by Tsagadai »

HNatWORK wrote: post #12

I believe Chrome shows the original source because when you View Source, it requests the page again. This complicates debugging Ajax requests (and also Get and Post requests). Firefox and IE show the "current" source, which is liable to be replaced as shown by dave1010uk. Type the following into the Chrome Dev Tools console, then the Firebug console: testBool = true; document.write(''); typeof testBool; Chrome shows…

If you right click in Chrome for 'inspect element' you also get disappearing source code.

Re: Firefox and IE's "View source" can be spoofed to show anything

#34

Post by sesqu »

Flam wrote: post #29

One of the many reasons why I recommend using NoScript. http://noscript.net/

I use NoScript, but I have it set up to allow embeds and top-level references. Denying those is a stone's throw away from just turning off javascript completely, which would be tiring.

Re: Firefox and IE's "View source" can be spoofed to show anything

#35

Post by sesqu »

knotty66 wrote: post #30
HNatWORK wrote: post #12

I believe Chrome shows the original source because when you View Source, it requests the page again. This complicates debugging Ajax requests (and also Get and Post requests). Firefox and IE show the "current" source, which is liable to be replaced as shown by dave1010uk. Type the following into the Chrome Dev Tools console, then the Firebug console: testBool = true; document.write(''); typeof testBool; Chrome shows…

I wondered if there is anything different about the second (view source) request that could be detected and a different response provided - but I don't think so after a quick look with WireShark.

Well, you could set up a temporary client blacklist based on cookies or IP addresses.

Re: Firefox and IE's "View source" can be spoofed to show anything

#36

Post by AndyKelley »

dave1010uk wrote: post #8
xorglorb wrote: post #7

Since the site seems to be down, you can read the article (no images unfortunately) in Google's Cache[1]. [1]: https://webcache.googleusercontent.com/search?q=cache:http:/...

I've recreated a simple proof of concept here: http://taskthere.com/viewsource/ It works in Firefox 6, not sure about any other browsers. If you want to see the actual source, disable JavaScript (or use Chrome or curl).

When I refresh the page, I don't see the alert again. Did you even check any referrers, or just set a flag to only show the alert once?

Re: Firefox and IE's "View source" can be spoofed to show anything

#38

Post by sjs »

Flam wrote: post #29

One of the many reasons why I recommend using NoScript. http://noscript.net/

Although I don't use NoScript (or NotScripts) anymore the web was far less annoying without arbitrary JavaScript. I never had to leave a site because some irrelevant box popped up over the page I was looking at, or about to be.

It will be effective at blocking the Flash-like HTML ads that are going to pop up soon as well. Unless they get really creative with CSS.

Re: Firefox and IE's "View source" can be spoofed to show anything

#39

Post by dave1010uk »

AndyKelley wrote: post #36
dave1010uk wrote: post #8

Earlier quoted context omitted.

I've recreated a simple proof of concept here: http://taskthere.com/viewsource/ It works in Firefox 6, not sure about any other browsers. If you want to see the actual source, disable JavaScript (or use Chrome or curl).

When I refresh the page, I don't see the alert again. Did you even check any referrers, or just set a flag to only show the alert once?

Nope, it's incredibly basic, just the HTML you see. I wrote the code on my phone and didn't have time to do anything like that. Here's the source: http://i.imgur.com/zV937.png - it should work served as a local file too.

It could be your browser blocking sequential alerts or some strange caching issue.

Re: Firefox and IE's "View source" can be spoofed to show anything

#40

Post by dave1010uk »

fgaaghf wrote: post #22
dave1010uk wrote: post #20

Earlier quoted context omitted.

I used an alert as a quick example. You could put any HTML or JS on the page (e.g. links for SEO value, iframes with PDF exploits, a bitcoin miner or a video of Rick Astley) and when someone views the source it looks like there's nothing malicious. Ctrl/Cmd-u can also be used to view source in Firefox.

If you want to view the current HTML source in Firefox you can use Ctrl+A and then right-click > "View Selection Source". I think it's more a question of what do you expect to see when you "View Source". For example, I have messed around with document.write a lot and it's pretty obvious to me that, if I use view source then it's going to give me the source and any changes done to it my document.write/open/close. In t…

This bug isn't showing the usual generated source but some kind of hybrid between original source and generated source.

- To see the original source, hit ctrl-u before dismissing the alert.

- To see the "hybrid" source, hit ctrl-u after dismissing the alert. I always expected this to be idential to what the webserver sent, just syntax highlighted. (Though I haven't messed around with document.close before.)

- To see the generated source, hit ctrl-a, right click & "View Selection Source". This is different to the original/hybrid source as Firefox inserts html tags to make the page valid. My example had no html, head, title or body tags. This should reflect the current page DOM, as affected by any JavaScript.

Post reply on HN