24

Can JavaScript be used to capture the user’s screen? If so, is this functionality available in any JS framework?

(I do not need code examples: I am mainly asking to form an opinion about the security capabilities of JavaScript.)

  • 2
    Of course, you can write C++ bindings for node.js to capture the user's screen - but I'm sure that's not what you're asking about :) – 小太郎 Nov 26 '14 at 2:41
  • 1
    Yes, but only in Chrome and with some requirements: code.google.com/p/webrtc/issues/detail?id=1757 – Rob W Nov 26 '14 at 7:47
26

JavaScript has full access to the document object model, so at least in theory, it could capture what's on its own web page (but not anything outside the browser window) and there's a library to do that: http://html2canvas.hertzen.com/ (I haven't tried it.)

The same-origin policy prevents JavaScript from accessing the DOM of another site. Since JavaScript cannot access the DOM of another site, it cannot leak material from the other site. So, if your question boils down to whether a script running in one tab, or even an iframe, can capture the banking password from elsewhere in the browser, then no, provided same-origin is properly implemented in the browser itself.

Same origin applies to domain from which the page was served, not from which the script was served. So, my page at hxxp://bbrown.spsu.edu/ (it wasn't interesting, and now it's dead because I've retired) can load a script from google-analytics.com, as it does, and that script has access to the DOM of the page from which it was loaded; it can also send stuff back to Google through a bit of sleight-of-hand. The point is, it can do that only because I trusted Google Analytics enough to load their script in my page; the code that loads the page is in markup I wrote. If you load my page into your browser, that script from google-analytics.com can see only the DOM of my page in your browser, and not anything else you may have open in your browser.

  • 3
    Mr Pedantic here but you state "or using Ajax or another mechanism from sending information other than to the server that served the page initially.". There are very few restrictions on sending information out of the same-origin. An easy way is to add <img src="example.com?any=information&goes=here"> or you can use javascript to create a same domain iframe with a form which then posts to another domain. – David Waters Nov 25 '14 at 23:29
  • 1
    I feel like "but not anything outside the browser window" should be put in bold as it is the key idea. – IQAndreas Nov 26 '14 at 1:02
  • 2
    @IQAndreas: It's very important not to overuse emphasis. People who read my answer thoughtfully will get the point without my having shoved it in their faces, and may even find flaws, as David Waters did. – Bob Brown Nov 26 '14 at 2:44
  • 1
    I've used html2canvas to great effect. It's an excellent library and I'm glad to see it recommended here. +1 – L0j1k Nov 26 '14 at 8:39
  • 6
    @Blackhole: While it is very important to me that thousands of people see the boring list of classes I teach, my primary purpose was to provide a concrete example that people could actually visit and view the source code. I could substitute a link to my neighbor's law firm if you like. – Bob Brown Nov 26 '14 at 9:39
2

Besides capturing the screen with Javascript, a common thing is tracking a users mouse movements/actions on a web page. This previous question on StackOverflow shows how to capture the position of the mouse in Javascript and jQuery. With this information, people can take those mouse positions and map them with a screenshot of the web page (created using another method). Some common tools like Lucky Orange and Crazy Egg create heat maps of web pages so webmasters can see what people are doing on the website.

As this question relates to security, there is some security concern over being able to see mouse movements on a web page. Hackers may use this information for or as a part of phishing attacks. But I don't think it is a real concern.

1

getUserMedia(); can capture the entire desktop.

This functionality is experimental, so you will need to direct the user to enable it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.