The difference is, I can put custom JS on my Github page and send you a link, when you open it you run code I authored.
Developer console is just me running code, and is also on any arbitrary domain on any site.
My understanding of this article was that he pulled off the hack entirely by himself, without having to get someone to visit his page. Maybe I misunderstood.
no difference. but running XSS in console is shooting your leg
Re:Hacking Github with Webkit
by underwater on Saturday March 09, 2013 @04:11PM
(#5349651)
What you're referring to is a self-XSS. They were a lot more common back when you could run JavaScript from the address bar.
These days if you try and paste JavaScript to your address bar (try it with: javascript:alert(1);) then the browsers try and stop you. Firefox just won't execute any JavaScript, even if you've manually typed it. IE and Chrome strip the "javascript:" prefix (but Chrome is vunerable if you type "j" and paste the remainder).
More info here: https://www.facebook.com/photo.php?v=956977232793
What is the difference between allowing users to put custom JS on a subdomain, vs. someone just opening up the developer console and running whatever JS they like? Does JS loaded from the server have different privileges to JS entered at the console?