Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I often hear about how client side JavaScript can't be relied on because it can easily be changed. How exactly can it be changed, what program would be used to modify the JavaScript before a page renders? Obviously in a browser if you choose "view source" you see it but how would an attacker change it?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

BURP proxy allows you to modify http request made by the browser as well as http responses. Using this tool you could modify JavaScript or modify the requests made by JavaScript to attack the server-side system.

Also you can edit JavaScript using Chrome's Developer Tools or firebug for firefox.

share|improve this answer
3  
In addition to the excellent Burp proxy tool mentioned by @Rook, I often use Firebug for javascript editing and debugging. It is an add on for both firefox and google chrome. –  void_in Apr 23 '13 at 4:12

I'm assuming you aren't referring to MITM attacks because if one has a man in the middle situation there is rarely a need to modify Javascript in transit, because the middle man can impersonate the server to the client or vice versa.

If you are referring to why you can't use client-side JS for validation purposes, keep in mind the client is not trusted. The client can do whatever it wants; the server has to protect itself.

It could be as simple as:

  1. Download web page as html and/or js.
  2. Change to heart's content.
  3. Open in browser.

No complicated tools required; just a browser and notepad.

Of course if someone wants to write their HTTP code directly they can completely dispense with the Javascript and just send malicious queries to the server directly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.