3 ms·

I am not sure that it is safe to open devtools on a sketchy website. There is a lot of extra attack surface there.

prmoustache 2y ago
Usually the sketchy websites are the one you open from an ephemeral VM anyway. Who would open those on their main desktop?
- out-of-ideas 2y ago
  i'd argue any website with a 3rd party ad is a sketchy website. but any site can do it check out https://github.com/AEPKILL/devtools-detector https://github.com/AEPKILL/devtools-detector
mathfailure 2y ago
Why does opening devtools on any sites is not safe?
shbooms 2y ago
What can a website do just from opening dev tools that it can't do without opening them?
- out-of-ideas 2y ago
  it can basically fork bomb the user
  - chatmasta 2y ago
    The websites I've seen (and was referencing in the Gist) basically do this. But it's a very simple anti-debugger technique that uses an IIFE containing a `while` loop with a `debugger;` statement in every iteration. You can circumvent it by opening DevTools on another website and toggling it to "skip all breakpoints." I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors. And I'm sure that the attack surface for actual exploits (beyond just DOS) is also greater than browsing a website without DevTools open. But it's not like browser vendors grant super-permissions to websites when the user has DevTools open; any exploit would depend on a high severity vulnerability. I do agree that it's probably smart to browse sketchy websites in an isolated browser, and ideally one inside a VM.
    - tamimio 2y ago
      > I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors. Just rename debugger to banana. Edit: I see you have posted it below already! https://www.nullpt.rs/evading-anti-debugging-techniques https://www.nullpt.rs/evading-anti-debugging-techniques
out-of-ideas 2y ago
while i agree, 2 things come to mind to assist this: - browsers should have a user-input string for the debug statement that is manually accepted before the debugger runs every time devtools launches (and should be randomly generated each time that devtools is opened) - browser plugins help: check out Netmon (though sadly its yet-another-plugin and js-bloat for the browser to handle) edit: format i hope
- chatmasta 2y ago
  This researcher [0] found the optimal solution was to use a custom build of Firefox with the `debugger` keyword changed to something else :) [0] https://www.nullpt.rs/evading-anti-debugging-techniques https://www.nullpt.rs/evading-anti-debugging-techniques
  - out-of-ideas 2y ago
    yes i remember reading something about somebody compiling it to a unique word! wanted to do similar myself (but didnt fall down that rabbit hole yet) - i feel it should be a set-able in the browser (per tab or whatever) - not to sound like a broken record ha browsers are supposed to be a tool we humans use, not be controlled by edit: format maybe one day ill get it right

Usually the sketchy websites are the one you open from an ephemeral VM anyway. Who would open those on their main desktop?

out-of-ideas 2y ago
i'd argue any website with a 3rd party ad is a sketchy website. but any site can do it check out https://github.com/AEPKILL/devtools-detector https://github.com/AEPKILL/devtools-detector

mathfailure 2y ago

Why does opening devtools on any sites is not safe?

shbooms 2y ago

What can a website do just from opening dev tools that it can't do without opening them?

out-of-ideas 2y ago
it can basically fork bomb the user
- chatmasta 2y ago
  The websites I've seen (and was referencing in the Gist) basically do this. But it's a very simple anti-debugger technique that uses an IIFE containing a `while` loop with a `debugger;` statement in every iteration. You can circumvent it by opening DevTools on another website and toggling it to "skip all breakpoints." I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors. And I'm sure that the attack surface for actual exploits (beyond just DOS) is also greater than browsing a website without DevTools open. But it's not like browser vendors grant super-permissions to websites when the user has DevTools open; any exploit would depend on a high severity vulnerability. I do agree that it's probably smart to browse sketchy websites in an isolated browser, and ideally one inside a VM.
  - tamimio 2y ago
    > I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors. Just rename debugger to banana. Edit: I see you have posted it below already! https://www.nullpt.rs/evading-anti-debugging-techniques https://www.nullpt.rs/evading-anti-debugging-techniques

out-of-ideas 2y ago

while i agree, 2 things come to mind to assist this: - browsers should have a user-input string for the debug statement that is manually accepted before the debugger runs every time devtools launches (and should be randomly generated each time that devtools is opened) - browser plugins help: check out Netmon (though sadly its yet-another-plugin and js-bloat for the browser to handle) edit: format i hope

chatmasta 2y ago
This researcher [0] found the optimal solution was to use a custom build of Firefox with the `debugger` keyword changed to something else :) [0] https://www.nullpt.rs/evading-anti-debugging-techniques https://www.nullpt.rs/evading-anti-debugging-techniques
- out-of-ideas 2y ago
  yes i remember reading something about somebody compiling it to a unique word! wanted to do similar myself (but didnt fall down that rabbit hole yet) - i feel it should be a set-able in the browser (per tab or whatever) - not to sound like a broken record ha browsers are supposed to be a tool we humans use, not be controlled by edit: format maybe one day ill get it right