Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true?

Does this mean the webserver may issue alternate source from the original?

Lastly, is there a tool that I should use (or shouldn't use) specifically when looking at rogue HTTPS source code?

share|improve this question
add comment

9 Answers

up vote 6 down vote accepted

Yes, modern browsers such as Firefox, Chrome do make a second requests if you view source. And that does mean the source may be different from the one that is being displayed.

If you want the original source, you should use some add-on such as web developer toolbar (https://addons.mozilla.org/en-US/firefox/addon/60). Then use View Generated Source.

share|improve this answer
    
Modern browsers? ;) –  SteveS Oct 1 '11 at 1:02
    
Yea, old ones (such as my beloved Opera) did not, and still do not have this behavior. Neat! –  Nam Nguyen Oct 1 '11 at 11:47
    
@Nam Nguyen: Stable release 11.51 (Build 1087) (August 30, 2011; 36 days ago) Yup, old as dirt ;) –  Piskvor Oct 6 '11 at 7:25
    
@NamNguyen I believe this is now false, the latest Chrome (v20) doesn't issue a new request to view source. –  Pacerier Jul 17 '12 at 22:10
add comment

The safest way to pull source code for a website is with a client that can't render/execute the content that comes down.

You want to look for something that simply pulls data -- like netcat, or curl, or a custom script/application that makes raw HTTP requests.

But again, the key is to use something that is impervious to the downloaded content because it doesn't understand it.

share|improve this answer
add comment

It depends on which level you want to see the source code.

Firefox's View Source gives you the source code as seen by the render engine; unfortunately, FF itself applies a few transformations before the render engine gets to see it, and there's some caching involved, so it's not always reliable.

Tools like curl and wget will show you the exact response at the HTTP level (including HTTP headers, if you ask for them). This is usually good enough, and they'll transparently handle HTTPS for you so you don't have to worry about the SSL part of the protocol.

If you want to dive a bit deeper, try netcat or telnet - these basically give you a byte-stream connection to the server, allowing you to type (or pipe) HTTP requests directly, and view the raw response. The downside is that if you violate the protocol, you'll be kicked out of the connection.

To go yet a level deeper, consider a network sniffer - wireshark is excellent, but fairly complex; it will give you the raw packets as well as their contents at different levels of the network stack.

share|improve this answer
add comment

On Firefox I use Firebug for that. F12 activates firebug.

On Chrome there is a built in "Tools for developers" Ctrl+Shift+I or menu->Tools -> "Tools for developers".

Both can display current DOM tree (modified by scripts) as well as raw HTTP requests and responses.

share|improve this answer
add comment

Malzilla is a Swiss army knife when it comes to dissecting foreign code in Windows . Not only can it view source, but it can help someone de-obfuscate "funny" javascript code.

enter image description here

share|improve this answer
add comment

If you're worried that View Source gets you something else than actually goes over the wire, I highly recommend Fiddler: it's a capturing HTTP(S) proxy that sits between your browser and the network, and shows you the actual requests and responses before the browser gets to them (thus, you're seeing the exact same data as the browser, without any additional requests). It has various tools to analyze the content, including viewing the source.

share|improve this answer
add comment

Out of curiosity where did you hear that?

My understanding was that all browsers viewed the source of the cached file. But since Firefox uses a custom protocol for viewing source, it may be possible to view the source of a file that isn't cached, so it would need to make a request for it.

share|improve this answer
    
A colleague of mine PM'ed me. I'm just trying to verify. I'm mobile right now and am on a Blackberry Playbook... can't test it out. –  makerofthings7 Sep 30 '11 at 23:57
add comment

Ctrl + U is the easiest way to view website source code! In firefox browser.

share|improve this answer
add comment

chrome and firefox does if you open it in a new tab. The live editors doesn't (F12/right click in chrome). Safari doesn't - but it doesn't format the source either (like old IE).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.