Recreating websites with php - javascript

At school, there are blocks on sites. I intend to undo that. Even if I don't, I like this idea. So: I have a php page (source.php) to get source code of any site (no cross site ajax).
<?php
echo file_get_contents(urldecode($_GET["url"]));
?>
<script>
if(document.getElementsByTagName("base")[0])
document.getElementsByTagName("base")[0].href="<?php echo $_GET["url"] ?>";
else
document.head.appendChild(document.createElement("base").href="<?php
echo $_GET["url"] ?>");
</script>
Simple. Here is the index.html
<html><head><title>Unblocker</title></head><body>
<div width="100%" height="10%">
<form onsubmit="return go()">
<input id="url" value="http://www.google.com/">
<input type="submit" value="Go">
</form>
</div>
<div width="100%" height="90%">
<iframe src="http://www.google.com/" width="100%" height="100%" id="frame">
</iframe>
</div></body></html>
And now the javascript (to be inserted into the head tag)
function go(){
url=document.getElementById("url").value;
frame=document.getElementById("frame");
//do some url validations, not posting cause doesn't matter
if(url.isValid)//example
frame.contentWindow.location=location.protocol+"//"+location.hostname+"/
source.php?url="+url;
return false;//to prevent page reload
}
A couple of things: First, is this legal, taking whole source codes and displaying them despite my good intent? Also, will it work, or is there anything obvious that can make it better? I know that the server side can't be filtered (assuming that this site is not blocked!). I know that it is very limited, but I might be able to expand it to allow clicking links and all.

You intend to write a proxy. I think you should simply use http://www.phpproxy.net or look for a proxy software and install it on your server.
OR you could go on and do it. You could end up with a product and you will have learned a lot about the HTTP protocol and creating a proxy. Surely more than you can learn at school.
Proxies are not illegal, but it's probably against your school rules, assuming they have those rules written down somewhere and they didn't forget about the proxy thing. :)

Is it legal? Sure, you are viewing interpreted source code on every page you go to. That doesn't mean your school won't flog you for circumventing their firewall.
Will it work? Yes and no. You will get the source code, but most likely if you are viewing a blocked domain you won't be able to view any pictures. Your file_get_contents is grabbing the HTML and the links for the pictures. To get the pics and replace links your PHP script will have to be somewhat sophisticated.

Nice Idea. It sounds like you just want a proxy server tho.
Do you really think the FBI is going to come knocking on your door if they knew your PHP server was getting HTML? absolutely not. Servers everywhere do this every day, such as googlebot. I'd say you're in the clear.

Related

Use html/javascript to load new url upon visit

I need to make it so that when users visit a web page like example.com/news it automatically brings them to a different website like cnn.com without them having to click anything. It would be preferable if they would not even see the original web page and it would bring them directly to the other site (cnn.com in this case) I think I can use the onload event in html but I have little experience in javascript and don't know what code to use in order to accomplish this task. Thank you!I do not want to use jquery if possible.
Just one line of code (inside script tags)
<script>
window.location.href = "http://exampleurl.com";
</script>
You would be better off using headers. Depends what server side scripting language you are using. For PHP you would have the following:
header('Location: http://www.example.com/');

Auto login using Javascript and POST

I am trying to create a link that navigates to a 3rd party site and automatically logs in.
There is no API and the form doesn't support query strings. Security isn't an issue (I know passing variables in links isn't good practice but in our situation that's ok).
I can get it to work using VBS but IE makes it really tough to execute scripts.
I am now using Javascript:
function autoLogin() {
document.Form1.submit();
}
My HTML:
<form name="namofform" method=post action="www.websiteofloginpage.com">
<input type=hidden id=ID name="USERNAME" value="USERNAME"/>
<input type=hidden id=ID name="PASSWORD" value="PASSWORD"/>
</form>
I change the fields to the one on the form. When I execute the script (on load or by a link) it navigates to the page but isn't posting (logging in).
I noticed the submit button is using the _doPostBack - is that why it's not working trying from my a different site?
Have you looked into other cross-domain POSTing answers? There are certainly a variety of ways you can circumvent the same origin policies of browsers, but you won't be able to do it with simple JavaScript POSTing of forms.
See more here:
Cross Domain Form POSTing
Perhaps you can use a CORS-based or JSONp solution:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
What is JSONP all about?
Did you try to submit form with the good URI, generally we will have something like that: www.example.com/login. There also another point mentionned in Jim Miller's answer which is the Cross Domain Form POSTing.

Hide Links in Source code

I want to hide file links generated by php function in source code. I know its impossible to hide source code but i think there should be a way to hide php generated links in php code.
Here is the part of my code which used to generate links.
<?php foreach($tracks as $track){ ?>
<tr class="track"
data-track_order="<?php echo $track['menu_order']; ?>
"data-track_src=" <?php echo $track['audio_file']; ?>">
OUTPUT IN SOURCE
<tr class="track" data-track_order="2" data-track_src="http://domain.com/spins.mp3">
Is there any way in javascipt or in php vulnerability to make this hidden in source?
Well, From the above code, i tried so many encryptions methods but none of them worked.
I need any solution to make it hidden in source.
There are ways to try to get around this topic BUT the browser NEEDS to see the plain html code in order to render the webpage. Because of this current methods can be easily circumnavigated and they client will still be able to get hold of the link. So you can never fully stop the client getting your links BUT you can make it harder for them to get at it by using some techniques like javascript Obfuscation.
I presume that you want to hide the location so that people can't just retrieve the file without going through your site?
Instead of serving the file directly, have a php file serve the file. This file can then check that you are logged into the system, or have a time limited auth key that was generated from the page, whatever you think may limit the ability to copy and paste the link.
If the client accessing the file doesn't pass the checks, you serve them an authorisation failure header instead of the file contents.
What is the purpose of hiding the link? To stop people from being able to see the file location, or to stop anything other than your application from accessing the MP3's?
You can program the link into your JavaScript and obfuscate it which will make it hard for the end user to see the link but ultimately its impossible to complete hide it if you are sending the end user to that page.
If you want to simply stop people from accessing the MP3 location(s) you might be better off looking at putting a .htaccess / mod rewite on the directory that they are residing in, or, have a single .php page to load in the MP3's that will authenticate the referrer and/or server IP address before loading the required file.

How do I protect JavaScript files?

I know it's impossible to hide source code but, for example, if I have to link a JavaScript file from my CDN to a web page and I don't want the people to know the location and/or content of this script, is this possible?
For example, to link a script from a website, we use:
<script type="text/javascript" src="http://somedomain.example/scriptxyz.js">
</script>
Now, is possible to hide from the user where the script comes from, or hide the script content and still use it on a web page?
For example, by saving it in my private CDN that needs password to access files, would that work? If not, what would work to get what I want?
Good question with a simple answer: you can't!
JavaScript is a client-side programming language, therefore it works on the client's machine, so you can't actually hide anything from the client.
Obfuscating your code is a good solution, but it's not enough, because, although it is hard, someone could decipher your code and "steal" your script.
There are a few ways of making your code hard to be stolen, but as I said nothing is bullet-proof.
Off the top of my head, one idea is to restrict access to your external js files from outside the page you embed your code in. In that case, if you have
<script type="text/javascript" src="myJs.js"></script>
and someone tries to access the myJs.js file in browser, he shouldn't be granted any access to the script source.
For example, if your page is written in PHP, you can include the script via the include function and let the script decide if it's safe" to return it's source.
In this example, you'll need the external "js" (written in PHP) file myJs.php:
<?php
$URL = $_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
if ($URL != "my-domain.example/my-page.php")
die("/\*sry, no acces rights\*/");
?>
// your obfuscated script goes here
that would be included in your main page my-page.php:
<script type="text/javascript">
<?php include "myJs.php"; ?>;
</script>
This way, only the browser could see the js file contents.
Another interesting idea is that at the end of your script, you delete the contents of your dom script element, so that after the browser evaluates your code, the code disappears:
<script id="erasable" type="text/javascript">
//your code goes here
document.getElementById('erasable').innerHTML = "";
</script>
These are all just simple hacks that cannot, and I can't stress this enough: cannot, fully protect your js code, but they can sure piss off someone who is trying to "steal" your code.
Update:
I recently came across a very interesting article written by Patrick Weid on how to hide your js code, and he reveals a different approach: you can encode your source code into an image! Sure, that's not bullet proof either, but it's another fence that you could build around your code.
The idea behind this approach is that most browsers can use the canvas element to do pixel manipulation on images. And since the canvas pixel is represented by 4 values (rgba), each pixel can have a value in the range of 0-255. That means that you can store a character (actual it's ascii code) in every pixel. The rest of the encoding/decoding is trivial.
The only thing you can do is obfuscate your code to make it more difficult to read. No matter what you do, if you want the javascript to execute in their browser they'll have to have the code.
Just off the top of my head, you could do something like this (if you can create server-side scripts, which it sounds like you can):
Instead of loading the script like normal, send an AJAX request to a PHP page (it could be anything; I just use it myself). Have the PHP locate the file (maybe on a non-public part of the server), open it with file_get_contents, and return (read: echo) the contents as a string.
When this string returns to the JavaScript, have it create a new script tag, populate its innerHTML with the code you just received, and attach the tag to the page. (You might have trouble with this; innerHTML may not be what you need, but you can experiment.)
If you do this a lot, you might even want to set up a PHP page that accepts a GET variable with the script's name, so that you can dynamically grab different scripts using the same PHP. (Maybe you could use POST instead, to make it just a little harder for other people to see what you're doing. I don't know.)
EDIT: I thought you were only trying to hide the location of the script. This obviously wouldn't help much if you're trying to hide the script itself.
Google Closure Compiler, YUI compressor, Minify, /Packer/... etc, are options for compressing/obfuscating your JS codes. But none of them can help you from hiding your code from the users.
Anyone with decent knowledge can easily decode/de-obfuscate your code using tools like JS Beautifier. You name it.
So the answer is, you can always make your code harder to read/decode, but for sure there is no way to hide.
Forget it, this is not doable.
No matter what you try it will not work. All a user needs to do to discover your code and it's location is to look in the net tab in firebug or use fiddler to see what requests are being made.
From my knowledge, this is not possible.
Your browser has to have access to JS files to be able to execute them. If the browser has access, then browser's user also has access.
If you password protect your JS files, then the browser won't be able to access them, defeating the purpose of having JS in the first place.
I think the only way is to put required data on the server and allow only logged-in user to access the data as required (you can also make some calculations server side). This wont protect your javascript code but make it unoperatable without the server side code
I agree with everyone else here: With JS on the client, the cat is out of the bag and there is nothing completely foolproof that can be done.
Having said that; in some cases I do this to put some hurdles in the way of those who want to take a look at the code. This is how the algorithm works (roughly)
The server creates 3 hashed and salted values. One for the current timestamp, and the other two for each of the next 2 seconds. These values are sent over to the client via Ajax to the client as a comma delimited string; from my PHP module. In some cases, I think you can hard-bake these values into a script section of HTML when the page is formed, and delete that script tag once the use of the hashes is over The server is CORS protected and does all the usual SERVER_NAME etc check (which is not much of a protection but at least provides some modicum of resistance to script kiddies).
Also it would be nice, if the the server checks if there was indeed an authenticated user's client doing this
The client then sends the same 3 hashed values back to the server thru an ajax call to fetch the actual JS that I need. The server checks the hashes against the current time stamp there... The three values ensure that the data is being sent within the 3 second window to account for latency between the browser and the server
The server needs to be convinced that one of the hashes is
matched correctly; and if so it would send over the crucial JS back
to the client. This is a simple, crude "One time use Password"
without the need for any database at the back end.
This means, that any hacker has only the 3 second window period since the generation of the first set of hashes to get to the actual JS code.
The entire client code can be inside an IIFE function so some of the variables inside the client are even more harder to read from the Inspector console
This is not any deep solution: A determined hacker can register, get an account and then ask the server to generate the first three hashes; by doing tricks to go around Ajax and CORS; and then make the client perform the second call to get to the actual code -- but it is a reasonable amount of work.
Moreover, if the Salt used by the server is based on the login credentials; the server may be able to detect who is that user who tried to retreive the sensitive JS (The server needs to do some more additional work regarding the behaviour of the user AFTER the sensitive JS was retreived, and block the person if the person, say for example, did not do some other activity which was expected)
An old, crude version of this was done for a hackathon here: http://planwithin.com/demo/tadr.html That wil not work in case the server detects too much latency, and it goes beyond the 3 second window period
As I said in the comment I left on gion_13 answer before (please read), you really can't. Not with javascript.
If you don't want the code to be available client-side (= stealable without great efforts),
my suggestion would be to make use of PHP (ASP,Python,Perl,Ruby,JSP + Java-Servlets) that is processed server-side and only the results of the computation/code execution are served to the user. Or, if you prefer, even Flash or a Java-Applet that let client-side computation/code execution but are compiled and thus harder to reverse-engine (not impossible thus).
Just my 2 cents.
You can also set up a mime type for application/JavaScript to run as PHP, .NET, Java, or whatever language you're using. I've done this for dynamic CSS files in the past.
I know that this is the wrong time to be answering this question but i just thought of something
i know it might be stressful but atleast it might still work
Now the trick is to create a lot of server side encoding scripts, they have to be decodable(for example a script that replaces all vowels with numbers and add the letter 'a' to every consonant so that the word 'bat' becomes ba1ta) then create a script that will randomize between the encoding scripts and create a cookie with the name of the encoding script being used (quick tip: try not to use the actual name of the encoding script for the cookie for example if our cookie is name 'encoding_script_being_used' and the randomizing script chooses an encoding script named MD10 try not to use MD10 as the value of the cookie but 'encoding_script4567656' just to prevent guessing) then after the cookie has been created another script will check for the cookie named 'encoding_script_being_used' and get the value, then it will determine what encoding script is being used.
Now the reason for randomizing between the encoding scripts was that the server side language will randomize which script to use to decode your javascript.js and then create a session or cookie to know which encoding scripts was used
then the server side language will also encode your javascript .js and put it as a cookie
so now let me summarize with an example
PHP randomizes between a list of encoding scripts and encrypts javascript.js then it create a cookie telling the client side language which encoding script was used then client side language decodes the javascript.js cookie(which is obviously encoded)
so people can't steal your code
but i would not advise this because
it is a long process
It is too stressful
use nwjs i think helpful it can compile to bin then you can use it to make win,mac and linux application
This method partially works if you do not want to expose the most sensible part of your algorithm.
Create WebAssembly modules (.wasm), import them, and expose only your JS, etc... workflow. In this way the algorithm is protected since it is extremely difficult to revert assembly code into a more human readable format.
After having produced the wasm module and imported correclty, you can use your code as you normallt do:
<body id="wasm-example">
<script type="module">
import init from "./pkg/glue_code.js";
init().then(() => {
console.log("WASM Loaded");
});
</script>
</body>

How to load JavaScript intermixed with html

So I need to pull some JavaScript out of a remote page that has (worthless) HTML combined with (useful) JavaScript. The page, call it, http://remote.com/data.html, looks something like this (crazy I know):
<html>
<body>
<img src="/images/a.gif" />
<div>blah blah blah</div><br/><br/>
var data = { date: "2009-03-15", data: "Some Data Here" };
</body>
</html>
so, I need to load this data variable in my local page and use it.
I'd prefer to do so with completely client-side code. I figured, if I could get the HTML of this page into a local JavaScript variable, I could parse out the JavaScript code, run eval on it and be good to use the data. So I thought load the remote page in an iframe, but I can't seem to find the iframe in the DOM. Why not?:
<script>
alert(window.parent.frames.length);
alert(document.getElementById('my_frame'));
</script>
<iframe name="my_frame" id='my_frame' style='height:1px; width:1px;' frameBorder=0 src='http://remote.com/data.html'></iframe>
The first alert shows 0, the second null, which makes no sense. How can I get around this problem?
Have you tried switching the order - i.e. iframe first, script next? The script runs before the iframe is inserted into the DOM.
Also, this worked for me in a similar situation: give the iframe an onload handler:
<iframe src="http://example.com/blah" onload="do_some_stuff_with_the_iframe()"></iframe>
Last but not least, pay attention to the cross-site scripting issues - the iframe may be loaded, but your JS may not be allowed to access it.
One option is to use XMLHttpRequest to retrieve the page, although it is apparently only currently being implemented for cross-site requests.
I understand that you might want to make a tool that used the client's internet connection to retrieve the html page (for security or legal reasons), so it is a legitimate hope.
If you do end up needing to do it server-side, then perhaps a simple php page that takes a url as a query and returns a json chunk containing the script in a string. That way if you do find you need to filter out certain websites, you need only do this in one place.
The inevitable problem is that some of the users will be hostile, and they then have a license to abuse what is effectively a javascript proxy. As a result, the safest option may be to do all the processing on the server, and not allow certain javascript function calls (eval, http requests, etc).

Categories

Resources