6 ms·

Not that I think this has actually been applied by anyone in the wild, but it'd be fun to make a site that take advantage of this You can detect developer tool

Not that I think this has actually been applied by anyone in the wild, but it'd be fun to make a site that take advantage of this You can detect developer tools being open in Chrome pretty reliably, so detect dev tools have been open then "clean up your act" before there's a chance to view anything of note

codezero 5y ago
Could you see the original cookie by inspecting the headers of the network request? This would presumably be the value before the page loads and gives access to document.cookie or a change triggered by a server-side header.
- sk5t 5y ago
  Consider using something like https://mitmproxy.org/ https://mitmproxy.org/ to deal with a site so devious as to detect browser-level tools being used to inspect headers/cookies/etc.
duskwuff 5y ago
This has absolutely been used "in the wild". One particularly nasty strain of ad-block-evasion scripts would detect the developer tools being opened, and would reload the page and disable most of its features to prevent them from being analyzed.
- sroussey 5y ago
  Way back when, we thought about this for Firebug. One thing that came out of it was browsers started adding the console object (also because devs forgot to remove the calls on it). Even so, we added CSS and stuff to highlight elements and that was easily found. What do people look for today?
  - duskwuff 5y ago
    The two big ones are: 1. Watching window.innerHeight/innerWidth for sudden, large decreases, indicating that the user just opened the inspector. 2. Logging objects to the console with toString methods and checking if that method gets called.
    - hutzlibu 5y ago
      1. should be trivial to avoid, by opening dev tools in a new window but 2. I have no idea, except the browser vendors would add a "stealth dev mode"
      - petre 5y ago
        2. JSON.stringify(object)
        hutzlibu 5y ago
        But isn't the point that you want to detect what the foreign code does? So your solution would require inject your code into the code that wants to hide from you ... ?
        lmm 5y ago
        I think the idea is you patch the console to display the objects without calling their toString methods.
        BoorishBears 5y ago
        I don't think that works I might be off here, but I imagine console.log early exits if there's no console open, so it doesn't call toString If that's the case you can just write to the console in a loop and immediately know if one is open
        lmm 5y ago
        > I might be off here, but I imagine console.log early exits if there's no console open, so it doesn't call toString The point is to avoid calling toString when the console is open, by using some other way of displaying logged values.
- BoorishBears 5y ago
  The ad-block thing is where I first saw it, that and DRM for less-than-legal sites to prevent downloading (stops streaming if the dev console is open) I mean more specifically taking advantage of the awkward UI to cover up your tracks on local storage, it's something that's just devious enough that if you get caught (which is not difficult) it'll be hard to explain what you were doing, and you'll be trying to explain it to technical people
Thorrez 5y ago
Discord does this. Try to find the login cookie. When discord loads, it copies it out of localstorage into a js var and deletes the localstorage. So if you examine localstorage it will be empty. On page unload it copies it back into localstorage. So if you want to see the value, you have to make sure no discord tabs are open in your browser. I believe one reason for this is to prevent self-xss. It's hard for a malicious person to write a snippet of js to steal the login cookie now that it's no longer in localstorage. Another reason might be to prevent bots. It's hard for someone to automate a discord account if there's no way to get the account's login cookie.
- xg15 5y ago
  Wouldn't this cause problems with multiple tabs/windows? Like, if I have one Discord tab open (so localstorage is cleared) and I open a second one in parallel, will I be logged out in the second one?
  - Thorrez 5y ago
    I didn't look into it too deeply. Maybe if there are multiple windows they can communicate with each other in some way.
    - brabel 5y ago
      "in some way" --> probably postMessage to send the variable to the new tab.
  - toomanybeersies 5y ago
    Service workers would be the solution to that problem, wouldn't they?

codezero 5y ago

Could you see the original cookie by inspecting the headers of the network request? This would presumably be the value before the page loads and gives access to document.cookie or a change triggered by a server-side header.

sk5t 5y ago
Consider using something like https://mitmproxy.org/ https://mitmproxy.org/ to deal with a site so devious as to detect browser-level tools being used to inspect headers/cookies/etc.

duskwuff 5y ago

This has absolutely been used "in the wild". One particularly nasty strain of ad-block-evasion scripts would detect the developer tools being opened, and would reload the page and disable most of its features to prevent them from being analyzed.

sroussey 5y ago
Way back when, we thought about this for Firebug. One thing that came out of it was browsers started adding the console object (also because devs forgot to remove the calls on it). Even so, we added CSS and stuff to highlight elements and that was easily found. What do people look for today?
- duskwuff 5y ago
  The two big ones are: 1. Watching window.innerHeight/innerWidth for sudden, large decreases, indicating that the user just opened the inspector. 2. Logging objects to the console with toString methods and checking if that method gets called.
  - hutzlibu 5y ago
    1. should be trivial to avoid, by opening dev tools in a new window but 2. I have no idea, except the browser vendors would add a "stealth dev mode"
    - petre 5y ago
      2. JSON.stringify(object)
      - hutzlibu 5y ago
        But isn't the point that you want to detect what the foreign code does? So your solution would require inject your code into the code that wants to hide from you ... ?
        lmm 5y ago
        I think the idea is you patch the console to display the objects without calling their toString methods.
        BoorishBears 5y ago
        I don't think that works I might be off here, but I imagine console.log early exits if there's no console open, so it doesn't call toString If that's the case you can just write to the console in a loop and immediately know if one is open
        lmm 5y ago
        > I might be off here, but I imagine console.log early exits if there's no console open, so it doesn't call toString The point is to avoid calling toString when the console is open, by using some other way of displaying logged values.
BoorishBears 5y ago
The ad-block thing is where I first saw it, that and DRM for less-than-legal sites to prevent downloading (stops streaming if the dev console is open) I mean more specifically taking advantage of the awkward UI to cover up your tracks on local storage, it's something that's just devious enough that if you get caught (which is not difficult) it'll be hard to explain what you were doing, and you'll be trying to explain it to technical people

Thorrez 5y ago

Discord does this. Try to find the login cookie. When discord loads, it copies it out of localstorage into a js var and deletes the localstorage. So if you examine localstorage it will be empty. On page unload it copies it back into localstorage. So if you want to see the value, you have to make sure no discord tabs are open in your browser. I believe one reason for this is to prevent self-xss. It's hard for a malicious person to write a snippet of js to steal the login cookie now that it's no longer in localstorage. Another reason might be to prevent bots. It's hard for someone to automate a discord account if there's no way to get the account's login cookie.

xg15 5y ago
Wouldn't this cause problems with multiple tabs/windows? Like, if I have one Discord tab open (so localstorage is cleared) and I open a second one in parallel, will I be logged out in the second one?
- Thorrez 5y ago
  I didn't look into it too deeply. Maybe if there are multiple windows they can communicate with each other in some way.
  - brabel 5y ago
    "in some way" --> probably postMessage to send the variable to the new tab.
- toomanybeersies 5y ago
  Service workers would be the solution to that problem, wouldn't they?