Browser History Sniffing

By Salgoth
in Web Browser Discussion & Support

 Share

Recommended Posts

Mentor

kimsland

Posted
Posted
Links open in new windows. Although it is not required for the exploit, meta refreshes must be enabled to view this demo. * In most configurations.

Have a read here: http://forums.mozillazine.org/viewtopic.php?f=7&t=859575

Basically: (in Firefox)

about:config

accessibility.blockautorefresh

Double click on: "accessibility.blockautorefresh"

Try http://making-the-web.com/misc/sites-you-visit/nojs/ again :)

Community Regular

code.kliu.org

Posted
Posted (edited)

This isn't anything new: Mozilla has documented this "flaw" since 2000. The reason that this isn't that serious is that they can't retrieve an arbitrary history: just if you have visited a specific URL (not even a particular domain or site!) that it asks for. So unless the attacker explicitly asks if you've been to http://example.org/47, it will never know that you've been to http://example.org/47. It can't find that out by probing http://example.org/, http://example.org/47?x, or even http://example.org/47/. It must probe http://example.org/47, verbatim. Brute-forcing every possible URL? Yea, good luck with that. Brute-forcing every possible URL over a network connection? I think this just won the Most Impractical Exploit Award.

Practically, the extent of this flaw is to make for a nice sensationalist parlor trick for use by some grandstanding website that claims to have "discovered" a hole that people had known about for a decade, capable of determining if you've ever been to a common site, like google.com. Utterly useless for any sort of meaningful attack. Not to mention, it's slow and burdensome on the attacker's server.

As for disabling META refreshes, that's silly. It's not going to save you from this "exploit"--it's used by this particular demo, and that's it. I can use this exploit to sniff your browser history regardless of whether you have disabled META refreshes. And disabling META refreshes in general is usually a pretty big hit on usability (for a selective block of META refreshes, you can use NoRedirect, but with respect to this sniffing exploit, it's completely irrelevant).

Edited by code.kliu.org
Grand Master

The_Decryptor Veteran

Posted
  • Veteran
Posted (edited)

You have to stop :visited from working, you could do a "same origin" restriction on it, change getComputedStyle to always return the default state, or just plain break it. It's not that much of a "flaw" anyway, as code.kliu.org said you have to guess the exact URL used, but if you're paranoid you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.

A general way on how to do it (it'll report lime if it's visited, red otherwise).

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<html lang="en">
	<head>
		<title>Test</title>
		<style type="text/css">
			a { left: 0px; }
			a:visited { left: 1px; }
		</style>
	</head>
	<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
		<p><a href="http://www.google.com/">Google</a></p>
	</body>
</html>

Edit: How about an even better true/false method.

Edited by The_Decryptor
Mentor

Salgoth

Posted
  • Author
Posted

Thanks The_Decrytor and code.kliu.org!

This is what I love about Neowin! I'm a moron when it comes to coding but there are always some pretty BRILLIANT people on Neowin to set me straight.

I feel relaxed that it's such a difficult sniff to use and knowing it can be blocked if I wish by changing that layout.css.visited_links_enabled value.

Thanks again!

Mentor

kimsland

Posted
Posted
you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.

A general way on how to do it (it'll report lime if it's visited, red otherwise).

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<html lang="en">
	<head>
		<title>Test</title>
		<style type="text/css">
			a { left: 0px; }
			a:visited { left: 1px; }
		</style>
	</head>
	<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
		<p><a href="http://www.google.com/">Google</a></p>
	</body>
</html>

Edit: How about an even better true/false method.

I don't seem to have "layout.css.visited_links_enabled" in about:config (?)

Um I was a strong supporter for IE for many years, as:

If IE worked then Firefox could be checked

IE came with Windows

IE was required at MS Update Servers

So, how do I use that code again? (this looks to be the easiest option)

I know stoopy me, but what I do again in Firefox?

Yes real question.

Grand Master

The_Decryptor Veteran

Posted
  • Veteran
Posted
I don't seem to have "layout.css.visited_links_enabled" in about:config (?)

Um I was a strong supporter for IE for many years, as:

If IE worked then Firefox could be checked

IE came with Windows

IE was required at MS Update Servers

So, how do I use that code again? (this looks to be the easiest option)

I know stoopy me, but what I do again in Firefox?

Yes real question.

Are you using Firefox 3.5? The preference doesn't exist in 3.0.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Camtasia 2026.1.3

      By Copernic · Posted

      Camtasia 2026.1.3 by Razvan Serea TechSmith Camtasia is the complete professional solution for high-quality screen recording, video editing and sharing. Camtasia 2026 makes editing your videos easier, and faster than ever. The new editor is packed with enhanced video processing, all-new production technology, an innovative library, and stock videos and other creative assets to help you create more polished, professional videos. No video experience needed. Anyone can create informative, engaging videos. Create professional, eye-catching videos: Add special video effects - Apply Behaviors that are perfectly designed to animate your text, images, or icons. Get a crisp, polished look without being a professional video editor. Drag-and-drop your edits - What you see is what you get. Every effect and element in your video can be dropped and edited directly in the preview window. And you can edit at resolutions up to beautiful 4K, for clear video at any size. Get exceptional performance - Camtasia takes full advantage of your computer’s processor with 64-bit performance. You’ll get fast rendering times and enhanced stability—even on your most complex projects. Camtasia 2026.1.3 changelog: Feature Updates Improved keyboard navigability in tool panels. Improved screen reader accessibility of headings in Preferences. Tool panels can now be resized using a keyboard-navigable control. Updated color of folder icon in User Library tab for better visibility. Grouped media now render a composite waveform considering all audio media within that group. Added Long Path Aware to the manifest of Editor and Recorder. Performance Improvements Improved performance for editing groups on the timeline. Improved the project loading performance when timeline has lots of trec media with cursor data. Updates for IT Administrators Updated cpp-httplib from 0.38.0 to 0.43.3. Updated expat from 2.7.4 to 2.8.0. Updated freetype from 2.13.3 to 2.14.3. Updated harfbuzz from 13.0.1 to 14.2.0. Updated libpng16 from 1.6.55 to 1.6.58. Updated pango from 1.57.0 to 1.57.1. Updated girepository from 2.86.3 to 2.88.0. Updated pcre2-posix from 10.47.0 to 12.0.2. Added new harfbuzz-gpu.dll. Updated FFmpeg from 7.1.1 to 7.1.2. Updated aom from 3.11.0 to 3.13.1. Updated dav1d from 1.5.0 to 1.5.1. Updated ogg from 1.3.5 to 1.3.6. Updated SDL2 from 2.32.4 to 2.32.10. Updated zlib from 1.3.1 to 1.3.2. Updated Nalpeiron binaries to version 4.4.69.3. Bug Fixes Fixed an issue which prevented some user submitted crash reports from being sent. Fixed a potential memory leak when decoding HEVC or VP9 video. Fixed a potential crash when trying to delete a range selection on a magnetic track. Fixed a bug with the Properties Panel showing stale properties when only a caption is selected on the timeline. Fixed an issue that could prevent the Opacity and Blur properties from being changed in the Background Removal effect. Fixed an issue where larger Camtasia online projects may fail to open in Camtasia Editor. Table of contents thumbnails are no longer created for Smart Player exports with no table of contents. Fix resetting skew revert to revert just skew and not scale as well. Fixed editing in Snagit with snagX file with Unicode characters. Fixed a bug where grouped visual media could be cropped in some cases. Fixed importing SnagX files with Unicode characters. Localization fixes. Download: Camtasia 2026.1.3 | 309.0 MB (Shareware) View: Camtasia Homepage | Tutorials | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Spotify finally removes the disco ball app icon in the latest update

      By AsherGZ · Posted

      Huh never had this icon on Android
    • Can't access the forum on mobile

      By RaidenX · Posted

      yeah it seems to be Edge only. The dialog buttons work as expected in Chrome and Firefox. The phone is using Android 16 (OneUI 8.5) and Edge version  149.0.4022.53
    • Can't access the forum on mobile

      By Mindovermaster · Posted

      I'm not aware of this issue, but to help the other guys.  What version of Android are you using? Did you try a different browser? To see if Edge is the issue here.
    • Windows 11's big performance boost is finally available for all

      By +Good Bot, Bad Bot · Posted

      I agree when are you going to read this (really poor BTW) article? Here is a better article so you actually know what is going on and answers questions you had in other comments --> https://arstechnica.com/gadgets/2026/05/speed-boosting-low-latency-profile-is-one-of-the-improvements-coming-to-windows-11/ It is unclear if one will be able to disable the new profile at this point but I am not seeing any reason why one would.

  • Recent Achievements

    • One Month Later
      Jamswaz earned a badge
      One Month Later
    • Week One Done
      Jamswaz earned a badge
      Week One Done
    • Rookie
      Marzoid went up a rank
      Rookie
    • Community Regular
      coch went up a rank
      Community Regular
    • One Year In
      slackerzz earned a badge
      One Year In

  • Popular Contributors

    1. 1
      +primortal
      512
    2. 2
      PsYcHoKiLLa
      188
    3. 3
      +Edouard
      157
    4. 4
      Steven P.
      83
    5. 5
      ATLien_0
      75
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!