25

Can JavaScript be used to capture the user’s screen? If so, is this functionality available in any JS framework?

(I do not need code examples: I am mainly asking to form an opinion about the security capabilities of JavaScript.)

2
  • 2
    Of course, you can write C++ bindings for node.js to capture the user's screen - but I'm sure that's not what you're asking about :)
    – 小太郎
    Commented Nov 26, 2014 at 2:41
  • 1
    Yes, but only in Chrome and with some requirements: code.google.com/p/webrtc/issues/detail?id=1757
    – Rob W
    Commented Nov 26, 2014 at 7:47

3 Answers 3

26

JavaScript has full access to the document object model, so at least in theory, it could capture what's on its own web page (but not anything outside the browser window) and there's a library to do that: http://html2canvas.hertzen.com/ (I haven't tried it.)

The same-origin policy prevents JavaScript from accessing the DOM of another site. Since JavaScript cannot access the DOM of another site, it cannot leak material from the other site. So, if your question boils down to whether a script running in one tab, or even an iframe, can capture the banking password from elsewhere in the browser, then no, provided same-origin is properly implemented in the browser itself.

Same origin applies to domain from which the page was served, not from which the script was served. So, my page at hxxp://bbrown.spsu.edu/ (it wasn't interesting, and now it's dead because I've retired) can load a script from google-analytics.com, as it does, and that script has access to the DOM of the page from which it was loaded; it can also send stuff back to Google through a bit of sleight-of-hand. The point is, it can do that only because I trusted Google Analytics enough to load their script in my page; the code that loads the page is in markup I wrote. If you load my page into your browser, that script from google-analytics.com can see only the DOM of my page in your browser, and not anything else you may have open in your browser.

7
  • 3
    Mr Pedantic here but you state "or using Ajax or another mechanism from sending information other than to the server that served the page initially.". There are very few restrictions on sending information out of the same-origin. An easy way is to add <img src="example.com?any=information&goes=here"> or you can use javascript to create a same domain iframe with a form which then posts to another domain. Commented Nov 25, 2014 at 23:29
  • 1
    I feel like "but not anything outside the browser window" should be put in bold as it is the key idea.
    – IQAndreas
    Commented Nov 26, 2014 at 1:02
  • 2
    @IQAndreas: It's very important not to overuse emphasis. People who read my answer thoughtfully will get the point without my having shoved it in their faces, and may even find flaws, as David Waters did.
    – Bob Brown
    Commented Nov 26, 2014 at 2:44
  • 1
    I've used html2canvas to great effect. It's an excellent library and I'm glad to see it recommended here. +1
    – L0j1k
    Commented Nov 26, 2014 at 8:39
  • 6
    @Blackhole: While it is very important to me that thousands of people see the boring list of classes I teach, my primary purpose was to provide a concrete example that people could actually visit and view the source code. I could substitute a link to my neighbor's law firm if you like.
    – Bob Brown
    Commented Nov 26, 2014 at 9:39
2

Besides capturing the screen with Javascript, a common thing is tracking a users mouse movements/actions on a web page. This previous question on StackOverflow shows how to capture the position of the mouse in Javascript and jQuery. With this information, people can take those mouse positions and map them with a screenshot of the web page (created using another method). Some common tools like Lucky Orange and Crazy Egg create heat maps of web pages so webmasters can see what people are doing on the website.

As this question relates to security, there is some security concern over being able to see mouse movements on a web page. Hackers may use this information for or as a part of phishing attacks. But I don't think it is a real concern.

2

getUserMedia(); can capture the entire desktop.

This functionality is experimental, so you will need to direct the user to enable it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .