41–50 of 53 posts
The SANS course for this still teaches to use IE for debugging JS because it is the only browser that lets you break at arbitrary points in the code instead of newline boundaries.
Interesting though it involves recompiling the web browser. I have encountered this issue on many websites and my response is to stream the website through a proxy server which can then save the content (both outgoing and incoming) to the local disk for analysis. Using the browser's debugging tool is a lost cause when you're dealing with obfuscated code. The approach that I use is to isolate the target JS, modify it…
> Interesting though it involves recompiling the web browser. Years ago I really wanted to disable the blink tag, so I just ran `perl -pie "s/blank/abcde/g"` on the binary and that worked well enough. I'll bet you could so something similar with "debugger". On macOS, you'd break code signing, but you could re-sign it or strip the signing and let it run unsigned.
Unfortunately that won’t be an option with Web Integrity….
Glad you have said it. And before a developer for these commerce websites jumps up and says “ah but supreme are trying to prevent bots from buying up all of their merch and scalping it”: Supreme are restricting supply so they can maximise profits. They are selling on the web rather than through traditional retail outlets using this method not to reach a wider audience for the audience’s sake but to have a larger numb…
Earlier quoted context omitted.
The Javascript statement is simply "debugger". Very easy to abuse. Of course, there are other techniques for breaking devtools. There are JS libraries designed for the purpose of detecting that the dev console is open. The response may be to run the debugger command, freeze the code, reload the web page or, worse, do some serious hanky-panky (it's not hard to crash the web browser; an endless loop can do that).
> Problem is that the devtools are not available due to the repeated abuse of the debugger and console clear commands. What methods do they use to detect debugging tools and how do we defeat them?
Difficult to imagine any anti-debugging techniques that will work against something that just records an execution trace.
Earlier quoted context omitted.
Glad you have said it. And before a developer for these commerce websites jumps up and says “ah but supreme are trying to prevent bots from buying up all of their merch and scalping it”: Supreme are restricting supply so they can maximise profits. They are selling on the web rather than through traditional retail outlets using this method not to reach a wider audience for the audience’s sake but to have a larger numb…
Scalpers only exist because they are not raising the price to reduce demand. If they just wanted a higher price there is still room to go higher.
[x] only exists because it is underpriced relative to market demand.
A great question to ask after this is "would i be okay subjecting my child/mother/father to this experience?"
For example, there are 2 tennis courts available on a first come, first serve basis at a park in SF. Because they are free to reserve, and there's more demand than supply, people will bot all the courts at all given times during the day and scalp players for the free reservations.
Or, a car is available for [x] msrp price, plus a 25% "market adjustment" fee. Is this ethical for every dealer in the country to do the same?
heavy handed approach. I have some moderate success intercepting setInterval/setTimeout and manually sifting to find that one call that starts the ball rolling. Things get old fast when the code you are looking at looks like
0[_0x199d1e(0x815*-0x2+0x1735+0x13f*-0x5)](_0x199d1e(0x3b3*0xa+0x1c1+-0x260d),_0x199d1e(0x2149*0x1+0x9f7+0x1*-0x29f5)))[_0xEarlier quoted context omitted.
Scalpers only exist because they are not raising the price to reduce demand. If they just wanted a higher price there is still room to go higher.
Ah yes, the supply vs. demand argument. My favorite. [x] only exists because it is underpriced relative to market demand. A great question to ask after this is "would i be okay subjecting my child/mother/father to this experience?" For example, there are 2 tennis courts available on a first come, first serve basis at a park in SF. Because they are free to reserve, and there's more demand than supply, people will bot…
My memory of learning about "Wealth of Nations" style capitalism is there was an idea that people produce goods and services that other people find useful. So when they trade, both buyer and seller benefit. As opposed to scalpers, who interpose themselves between the two to the detriment of both the buyer and seller, and benefit only to the scalper.
Modern capitalist don't care if they make everything worse, only that someone is making money.
Earlier quoted context omitted.
Scalpers only exist because they are not raising the price to reduce demand. If they just wanted a higher price there is still room to go higher.
Ah yes, the supply vs. demand argument. My favorite. [x] only exists because it is underpriced relative to market demand. A great question to ask after this is "would i be okay subjecting my child/mother/father to this experience?" For example, there are 2 tennis courts available on a first come, first serve basis at a park in SF. Because they are free to reserve, and there's more demand than supply, people will bot…
Yes, if it means that a car that I want is in stock as opposed to having to wait for 6 months I would consider it ethical.
I'm surprised to not see Chrome's handy "Never pause here" menu that appears when you right click any line of JS, including debug breakpoints. This is typically what I do when there's a debug in an intervaled function (simple anti-debug commonly found on some video sites). Example: https://i.imgur.com/BsphnEu.png
I don’t think that works with eval code because it doesn’t have a file:0:0 address