Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Browsers follow certain standards to securely render webpages and execute scripts. But it's all in browser.
An example is that I can't access stuff inside a JS module from the browser console.
What if there exists a modified WebKit/gecko engine that follows no such standards and is specifically meant for offending the front-end? This way we can do things with the front-end that aren't allowed.
Does such a browser exist?
This feature is called "debugging" and is already implemented in all existing browsers.
You don't need a special dark web 1337 h4x0r version of Firefox in order to inspect the internals of a module. There is plenty of documentation online on how to analyze JavaScript in the context of pentesting.
The value of the type of front-end vulnerability you're thinking of lies in it being deployed unbeknownst to the user. If you install a cracked browser, it is you who are doing the deed.
The vulnerability remains if you install a cracked browser on someone else's computer, and then exploit its crackery to exfilter credentials, monitor navigation and so on.
A system's security lies in the back end. User input should never be trusted.
For example, a cracked browser - or Firefox Developer Tools - will allow you to inspect a front-end form and discover that a hidden field of a purchase form contains the invoice amount. You can then alter the field and apply yourself a hefty 90% discount, and submit the form. What happens is not that you get the merchandise at one tenth the price, but that the submission gets rejected. The server does not trust the sum total but runs it again on the prices as they are stored server side -- the only information that is "trusted" is the nature and quantity of the purchased items. You can alter your form to order a vodka bottle instead of a whiskey bottle, but it's no different from legitimately order a different bottle without recourse to any cracking whatsoever. You still can't change the vendor prices, and you still can't change anyone else's form. So, the ability of modifying those fields gets you nothing.
(Of course, there are ill-designed sites that will run a calculation, send the result to you, and then get it back and trust it to save time. These are bad design errors, not the rule).
A browser consists of:
If you want to be able carefully examine the requests, responses and JavaScript code, no need for a special tool: all major browsers provide a so called developper mode dedicated to that usage. This mode generally allows to resend a request after tweaking its content
If you want to go one step further, you can use a scripting language like Python which provides enough of the HTTP protocol to be able to send anything as a request.
Said differently, you can never be sure that request comes from a genuine user on a genuine brower. Tools for sending forged requests are simply too easy to find and use...
