News for hackers. Stuff that matters.

A comment on How does Facebook disable Developer Tools?. Parent comment

Re:How does Facebook disable Developer Tools? by Strom on Wednesday February 12, 2014 @12:37AM (#7222703)
Because pasting doesn't work. Most browsers (like Chrome, IE) just remove the javascript: prefix from your pasted text, and some browsers (like Firefox) don't allow you to execute standard javascript from the address bar.
[ Parent | on HN ]
Re:How does Facebook disable Developer Tools? by gkhnarik on Wednesday February 12, 2014 @12:46AM (#7222743)
I agree. Chrome doesn't allow you do paste it, you have to type it. I believe they disable it soon too.
[ Parent | on HN ]
Re:How does Facebook disable Developer Tools? by yen223 on Wednesday February 12, 2014 @01:55AM (#7222976)
See the link in the accepted answer. If you try to paste in "javascript: blahblahblah", Chrome is smart enough to remove the "javascript: " part. What the attackers do instead is to tell the victim to type "j", then ctrl+v the rest "avascript: blahblahblah". Just tried it in Chrome, it goes through.
[ Parent | on HN ]
Re:How does Facebook disable Developer Tools? by SomeoneWeird on Wednesday February 12, 2014 @02:06AM (#7223000)
Clever.
[ Parent | on HN ]