9 ms·
Tamper Chrome extension to modify requests in flight
- kevinwang 10y agoI've used this before to modify the leaderboard scores of small web games[0] I was amazed at how simple it was to use. Pretty full-featured, as well. [0]: http://kevinwang.us/cheating-a-guide-to-achieving-high-scores-without-hard-work/ http://kevinwang.us/cheating-a-guide-to-achieving-high-score...
- tomglynch 10y agoYour blog post is very interesting, replicated it in a game against some of my friends too. Very easy.
- niilzon 10y agoIf you believe 2 years of CS are required to achieve this.. Anybody with a brain can exploit this classic, basic flaw, without any CS studies but just some curiosity. Sorry to put it blundly like this though.
- zulln 10y agoEh hm... are you sure you replied to the correct comment?
- DorothySim 10y agoProbably yes. Sending scores in HTTP requests is such a low-hanging fruit for exploitation. A friend of mine was responsible for scoring system on games. As they had some real awards (like bikes, tickets etc.) they captured the entire flow of the game with various statistics and later analyzed them for weird variations. That was in Flash and people used browser plugins to slow down the play, that was easy to spot. Of course it won't stop 100% of attacks, but it raises a bar sufficiently to thwart most attempts.
- Gracana 10y agoDoes it require a CS degree to tell the author was joking, or can anyone with a brain do that, too?
- bpicolo 10y ago>file:///C:/Users/kevin/pornography/picturesofmyself/yearbook.jpeg nice
- platz 10y agothe tamper window seems to not open half the time leaving after specifying to tamper request headers, leaving chrome waiting for the extension with no way to resume the request
- ic4l 10y agoThere is also the trusty Charles app (https://www.charlesproxy.com/ https://www.charlesproxy.com/)
- amenghra 10y agoCharles proxy, Paros, Burp and Fiddler are all great tools to intercept and modify traffic. Great for debugging or just inspecting/reversing/hacking in general. Im glad if similar tools are being made available as browser extensions, it might lower the barrier to entry and get more people poking at the network layer. PS: https://github.com/square/PonyDebugger https://github.com/square/PonyDebugger is a cool debugger that lets you use Chrome developer tools when developing iOS apps. PS2: https://paw.cloud/ https://paw.cloud/ and some other tools take these proxies to a whole new level in terms of UI/polish.
- ic4l 10y agoAlso reminds you that you should be CAREFUL with what extensions you install. As they can pretty much do whatever they want ;)
- timrichard 10y agoGood point. I tend to disable all for Incognito mode, then use that mode for things like online banking. Are there better approaches, like dedicating a separate browser for super sensitive stuff with absolutely nothing installed?
- paulryanrogers 10y agoA separate, portable browser install would be wise. Even better if it's a bootable image of a trustworthy OS.
- jpalomaki 10y agoChrome supports multiple profiles and you have different extensions for them. So you create for example one special profile for web development.
- rfz 10y agoA bootable Linux distro that can be run from a USB key, like Puppy Linux.
- 10y ago
- synthecypher 10y agoThis functionality is built in to Firefox would be nice if it was the case in Chrome.
- matthewbauer 10y agoWhat do you mean? TamperData exists for Firefox but it is also an addon[1]. [1]: https://addons.mozilla.org/en-us/firefox/addon/tamper-data/ https://addons.mozilla.org/en-us/firefox/addon/tamper-data/
- SmellyGeekBoy 10y agoHow much functionality should browsers have built in? Seems like extra bloat for the 99.9% of users who'd never even need this, but the same could be said for most of the dev tools I guess.
- kevinmgranger 10y agoWhere is it in firefox? I think firefox only lets you edit and resend requests that have already been sent.
- homakov 10y agoCan it be extended so I could copy entire request in one click in some format (XAR is best)
- joshschreuder 10y agoCan't dev tools already do this? Right click request and copy as CURL, etc.
- homakov 10y agoYes, but you cannot cancel the request. If you go offline mode it lacks cookies. That's why I need an extension that blocks request first.