Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox and IE's "View source" can be spoofed to show anything

scriptjunkie.us

Post reply on HN
Print view View original

21–30 of 43 posts

Re: Firefox and IE's "View source" can be spoofed to show anything

#21

Post by cmelbye »

HNatWORK wrote: post #12

I believe Chrome shows the original source because when you View Source, it requests the page again. This complicates debugging Ajax requests (and also Get and Post requests). Firefox and IE show the "current" source, which is liable to be replaced as shown by dave1010uk. Type the following into the Chrome Dev Tools console, then the Firebug console: testBool = true; document.write(''); typeof testBool; Chrome shows…

I think that's correct about Chrome. If you want to see the "current" source, the Web Inspector is the way to go.

Re: Firefox and IE's "View source" can be spoofed to show anything

#22

Post by fgaaghf »

dave1010uk wrote: post #20
tspiteri wrote: post #17

Earlier quoted context omitted.

To see the actual source in Firefox 6, I just viewed the source without dismissing the alert, there was no need to disable anything. The only thing is that with the alert, I couldn't right click on the page and click on "View Page Source", I had to use the menu item Tools: Web Developer: Page Source (or its keyboard shortcut).

I used an alert as a quick example. You could put any HTML or JS on the page (e.g. links for SEO value, iframes with PDF exploits, a bitcoin miner or a video of Rick Astley) and when someone views the source it looks like there's nothing malicious. Ctrl/Cmd-u can also be used to view source in Firefox.

If you want to view the current HTML source in Firefox you can use Ctrl+A and then right-click > "View Selection Source".

I think it's more a question of what do you expect to see when you "View Source". For example, I have messed around with document.write a lot and it's pretty obvious to me that, if I use view source then it's going to give me the source and any changes done to it my document.write/open/close. In this case since document.write is used after HTML parsing has been completed it replaces the whole page and thus makes view source rather pointless.

Re: Firefox and IE's "View source" can be spoofed to show anything

#23

Post by Dobbs »

dave1010uk wrote: post #8
xorglorb wrote: post #7

Since the site seems to be down, you can read the article (no images unfortunately) in Google's Cache[1]. [1]: https://webcache.googleusercontent.com/search?q=cache:http:/...

I've recreated a simple proof of concept here: http://taskthere.com/viewsource/ It works in Firefox 6, not sure about any other browsers. If you want to see the actual source, disable JavaScript (or use Chrome or curl).

If I use pentadactyl's `gf` I get the source with the alert. If I right click I get the intended result.

Re: Firefox and IE's "View source" can be spoofed to show anything

#24

Post by estel »

dave1010uk wrote: post #8
xorglorb wrote: post #7

Since the site seems to be down, you can read the article (no images unfortunately) in Google's Cache[1]. [1]: https://webcache.googleusercontent.com/search?q=cache:http:/...

I've recreated a simple proof of concept here: http://taskthere.com/viewsource/ It works in Firefox 6, not sure about any other browsers. If you want to see the actual source, disable JavaScript (or use Chrome or curl).

Peculiar: in FF5 I don't see the alert, but do see it in view source.

Re: Firefox and IE's "View source" can be spoofed to show anything

#25

Post by JoachimSchipper »

HNatWORK wrote: post #12

I believe Chrome shows the original source because when you View Source, it requests the page again. This complicates debugging Ajax requests (and also Get and Post requests). Firefox and IE show the "current" source, which is liable to be replaced as shown by dave1010uk. Type the following into the Chrome Dev Tools console, then the Firebug console: testBool = true; document.write(''); typeof testBool; Chrome shows…

Note that re-downloading the source prevents this attack, but does not mean that the source you are looking at is what the page is actually running - just make the web server leave out the reference to evil.js the second time an IP address requests the page...

Re: Firefox and IE's "View source" can be spoofed to show anything

#27

Post by there »

code_duck wrote: post #4

Thankfully, curl can't be tricked in such a manner. I'd have a more substantial comment, I hope, if the site was loading.

Thankfully, curl can't be tricked in such a manner.

fetch http://jcs.org/tmp/nothing.html through curl:

      jcs@air:~> curl -s http://jcs.org/tmp/nothing.html 
      there is really nothing here, i can promise you that.
but you just aren't seeing the content.

     jcs@air:~> curl -s http://jcs.org/tmp/nothing.html | vis
     View source in Firefox. \^H\^H\^H\^H\^H\^H\^H\^H\^H\^H\^H[...]

Re: Firefox and IE's "View source" can be spoofed to show anything

#28

Post by tspiteri »

dave1010uk wrote: post #20
tspiteri wrote: post #17

Earlier quoted context omitted.

To see the actual source in Firefox 6, I just viewed the source without dismissing the alert, there was no need to disable anything. The only thing is that with the alert, I couldn't right click on the page and click on "View Page Source", I had to use the menu item Tools: Web Developer: Page Source (or its keyboard shortcut).

I used an alert as a quick example. You could put any HTML or JS on the page (e.g. links for SEO value, iframes with PDF exploits, a bitcoin miner or a video of Rick Astley) and when someone views the source it looks like there's nothing malicious. Ctrl/Cmd-u can also be used to view source in Firefox.

My intention was to suggest an easy way to view the actual source. I think your example is actually better as an example as it is easy to see the source both before and after the function is called.

Re: Firefox and IE's "View source" can be spoofed to show anything

#30

Post by knotty66 »

HNatWORK wrote: post #12

I believe Chrome shows the original source because when you View Source, it requests the page again. This complicates debugging Ajax requests (and also Get and Post requests). Firefox and IE show the "current" source, which is liable to be replaced as shown by dave1010uk. Type the following into the Chrome Dev Tools console, then the Firebug console: testBool = true; document.write(''); typeof testBool; Chrome shows…

I wondered if there is anything different about the second (view source) request that could be detected and a different response provided - but I don't think so after a quick look with WireShark.
Post reply on HN