6 ms·
How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
by joe_hoyle 13y ago
How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
- Strom 13y agoBecause pasting doesn't work. Most browsers (like Chrome, IE) just remove the javascript: prefix from your pasted text, and some browsers (like Firefox) don't allow you to execute standard javascript from the address bar.
- gkhnarik 13y agoI agree. Chrome doesn't allow you do paste it, you have to type it. I believe they disable it soon too.
- yen223 13y agoSee the link in the accepted answer. If you try to paste in "javascript: blahblahblah", Chrome is smart enough to remove the "javascript: " part. What the attackers do instead is to tell the victim to type "j", then ctrl+v the rest "avascript: blahblahblah". Just tried it in Chrome, it goes through.
- SomeoneWeird 13y agoClever.
- nbm 13y agoHave you tried doing that recently? Doesn't work on Firefox and Chrome, not for some time.
- deleted 13y ago[deleted]
- azernik 13y agoThat is the original exploit mentioned in the accepted answer; however, Firefox and IE have disabled execution of javascript from the address bar, and I assume that Chrome is also moving to do the same thing.
- gkhnarik 13y agoAnd after that Hackers will start telling people do open their Concole in Developer Tools and paste the code there. I believe many people will do.
- samplonius 13y agoBut you rapidly reach a point beyond which most users can get to. Three steps: (1) open console, (2) copy, (3) paste is about the limit on what an average computer user can do these days.
- jkrems 13y ago...which is exactly what this post is about..? That's the reason Facebook disables the DevTools console apparently.