Firefox and IE's "View source" can be spoofed to show anything • Hacker News Board

Re: Firefox and IE's "View source" can be spoofed to show anything

#11

Post by dave1010uk » Thu, Sep 08, 2011, 6:09 PM UTC

code_duck wrote: post #4

Thankfully, curl can't be tricked in such a manner. I'd have a more substantial comment, I hope, if the site was loading.

Depending on how well your terminal deals with things like high unicode characters and RTL, I wonder if you could trick curl. You could also send the curl user agent harmless HTML and send Firefox / IE user agents a nasty exploit - that would probably fool me for a while.

Re: Firefox and IE's "View source" can be spoofed to show anything

#12

Post by HNatWORK » Thu, Sep 08, 2011, 6:30 PM UTC

I believe Chrome shows the original source because when you View Source, it requests the page again. This complicates debugging Ajax requests (and also Get and Post requests).

Firefox and IE show the "current" source, which is liable to be replaced as shown by dave1010uk.

Type the following into the Chrome Dev Tools console, then the Firebug console:

  testBool = true;
  document.write('');
  typeof testBool;

Chrome shows boolean, firefox shows undefined.

Re: Firefox and IE's "View source" can be spoofed to show anything

#13

Post by 51Cards » Thu, Sep 08, 2011, 6:31 PM UTC

Tried in Firefox 6... spoof works. Tried in Firefox 3.6... could see full source, script and all.

Re: Firefox and IE's "View source" can be spoofed to show anything

#14

Post by Kwpolska » Thu, Sep 08, 2011, 6:32 PM UTC

Actually, chrome downloads the source again when you choose "view source". You can see the "modded" source with ctrl/cmd+shift+I.

Re: Firefox and IE's "View source" can be spoofed to show anything

#15

Post by abrowne » Thu, Sep 08, 2011, 6:42 PM UTC

Kwpolska wrote: post #14

Actually, chrome downloads the source again when you choose "view source". You can see the "modded" source with ctrl/cmd+shift+I.

If you mean the Developer Tools/Inspector, it's cmd+opt+I, at least on Chrome 14.

Re: Firefox and IE's "View source" can be spoofed to show anything

#16

Post by [deleted] » Thu, Sep 08, 2011, 6:47 PM UTC

abrowne wrote: post #15

Kwpolska wrote: post #14

Actually, chrome downloads the source again when you choose "view source". You can see the "modded" source with ctrl/cmd+shift+I.

If you mean the Developer Tools/Inspector, it's cmd+opt+I, at least on Chrome 14.

[deleted]

Re: Firefox and IE's "View source" can be spoofed to show anything

#17

Post by tspiteri » Thu, Sep 08, 2011, 7:16 PM UTC

dave1010uk wrote: post #8

xorglorb wrote: post #7

Since the site seems to be down, you can read the article (no images unfortunately) in Google's Cache[1]. [1]: https://webcache.googleusercontent.com/search?q=cache:http:/...

I've recreated a simple proof of concept here: http://taskthere.com/viewsource/ It works in Firefox 6, not sure about any other browsers. If you want to see the actual source, disable JavaScript (or use Chrome or curl).

To see the actual source in Firefox 6, I just viewed the source without dismissing the alert, there was no need to disable anything. The only thing is that with the alert, I couldn't right click on the page and click on "View Page Source", I had to use the menu item Tools: Web Developer: Page Source (or its keyboard shortcut).

Re: Firefox and IE's "View source" can be spoofed to show anything

#18

Post by kaitnieks » Thu, Sep 08, 2011, 7:35 PM UTC

Older Internet Explorer and Firefox versions displayed the source that was downloaded, not the one generated/modified by scripts. It makes so much more sense, especially since there was always an option to view the generated source (by using JavaScript for an example) but I don't see how you can access the downloaded source at all if View Source is replaced by View Generated Source. Hm, actually one could use FireBug and watch Net response I suppose, but that's inconvenient.

Re: Firefox and IE's "View source" can be spoofed to show anything

#19

Post by [deleted] » Thu, Sep 08, 2011, 7:36 PM UTC

kaitnieks wrote: post #18

Older Internet Explorer and Firefox versions displayed the source that was downloaded, not the one generated/modified by scripts. It makes so much more sense, especially since there was always an option to view the generated source (by using JavaScript for an example) but I don't see how you can access the downloaded source at all if View Source is replaced by View Generated Source. Hm, actually one could use FireBug…

[deleted]

Re: Firefox and IE's "View source" can be spoofed to show anything

#20

Post by dave1010uk » Thu, Sep 08, 2011, 7:41 PM UTC

tspiteri wrote: post #17

dave1010uk wrote: post #8

Earlier quoted context omitted.

I've recreated a simple proof of concept here: http://taskthere.com/viewsource/ It works in Firefox 6, not sure about any other browsers. If you want to see the actual source, disable JavaScript (or use Chrome or curl).

To see the actual source in Firefox 6, I just viewed the source without dismissing the alert, there was no need to disable anything. The only thing is that with the alert, I couldn't right click on the page and click on "View Page Source", I had to use the menu item Tools: Web Developer: Page Source (or its keyboard shortcut).

I used an alert as a quick example. You could put any HTML or JS on the page (e.g. links for SEO value, iframes with PDF exploits, a bitcoin miner or a video of Rick Astley) and when someone views the source it looks like there's nothing malicious.

Ctrl/Cmd-u can also be used to view source in Firefox.