19

If the owner of a web site wants to track who their users are as much as possible, what things can they capture (and how). You might want to know about this in order to capture information on a site you create or, as a user, to prevent a site from capturing data on you.

Here is a starting list, but I'm sure I have missed some important ones:

  1. Referrer (what web page had the link you followed to get here). This is a HTTP header.
  2. IP Address of the machine you are browsing from. This is available with the HTTP headers.
  3. User Agent (what browser you are using). This is a HTTP header.
  4. Cookie placed on a previous visit. This is a header, available only if a cookie was placed earlier and was not deleted by the user.
  5. Flash Cookie placed on a previous visit. Some users turn off cookies, but very few know how to turn off Flash cookies. Works like a normal cookie although it depends on Flash.
  6. Web Bugs. Place something small (like a transparent single-pixel GIF) on the page that's served up from a 3rd party. Some third parties (such as DoubleClick) will have their own cookies and can correlate with other visits the user makes (for a fee!).

Those are the common ones I think of, but there have to be LOTS of unusual ones. For instance, this:

  1. Time on the user's clock. Use JavaScript to transmit it.

... which I had never heard of before reading it here.

ADDED LATER (after reading this):

Please try to put just ONE item per answer, then we can use voting up to sort out the better/more-interesting ones. The list below is probably less effective.

Ah well... NEXT time I ask a question like this I'll set it up better.

And here are some of the best answers I got:

  1. James points out that IE transmits the .NET framework version.
  2. AviewAnew points out that one can find what sites you have visited.
  3. Mecki points out that Screen Resolution can be determined.
  4. Mecki also points out that any auto-fill information your browser has cached can be determined, by creating a hidden field, then reading it with JavaScript.
  5. jjrv points out that Flash can list the fonts on the user's machine.
  6. Kent points out that you can find out what websites a person has visited.
  7. Silver Dragon points out you can determine the location of the mouse within the browsing window using Flash and AJAX.
  8. Jim points out that you can tell what language the user has configured in their browser from a HTTP header.
  9. Jim also mentions that you can detect whether people are using Greasemonkey or something similar to modify the page.
Community
  • 1
  • 1
mcherm
  • 23,999
  • 10
  • 44
  • 50

12 Answers12

3

Modifications to your original:

  1. can be escaped ( i think its an option in some browsers )
  2. only avoidable with a proxy ( javascript can contravene this however with smart lookaround )
  3. is unreliable, easily forged.
  4. And assuming it was not wiped by browser closure ( session cookie ) and cookie is in the same domain/path

The real nasty ones are

  1. Using javascript to probe your network/lan
  2. Using javascript to access your firewall from behind the firewall and adjust its settings ( no joke )
  3. Using the feature of the "visited link" to determine which of a list of urls have been visited. ( deep history probing ! )
  4. Goodness knows what if the user has Windows/IE/ActiveX
Kent Fredric
  • 56,416
  • 14
  • 107
  • 150
2
  • There's a header that can include information about a proxy server the user is using, and that can also include the user's IP address (in which case the other IP is the one of the proxy)
  • Screen Resolution, Operating System, Color Depth, size of your taskbar (compare max and current resolution), if Java is enabled, Anti-Aliasing Fonts, Plugins Installed all via Javascript
  • A Java applet can give you a bunch of information as well, but I don't know what.
  • Sites you've visited
  • Details of your local network such as active hosts, web servers. Paper Also outlines drive-by printing, drive-by router modification

And this is all assuming the attacker doesn't pull off arbitrary code execution

Tom Ritter
  • 99,986
  • 30
  • 138
  • 174
2

Javascript can get more information than just time. E.g. screen resolution (+ color depth) being one of them.

See Getting Screen Resolution with JS

Everything JS can capture, can be transmitted using AJAX without the user performing any interaction. Other examples are (not all will work in every browser):

  • It can look into your browser history, e.g. what URL your browser would go if you hit back or forward.

  • The language of your browser (Note: usually the HTTP request will also contain a list of preferred languages for the page you request. However this list is user editable in the prefs of many browser, while JS can actually find out what the language translation your browser is using in the interface)

  • If your browser auto fills form fields (e.g. e-mail, username, etc.), JS can actually already read what your browser entered into the fields before you submitted the form (thus it can even read what your browser pre-filled there, even if you never submit the form at all).

A Java applet could also gather some information and transmit it, though there is not much information you wouldn't already get elsewhere. Since it's easy to get the IP of a visitor, it's possible to find out which online service he's using (looking up the IP at address services like IANA for USA or RIPE for Europe and so on) and there are services that translate IPs to country, so it's possible to find out where the user most likely is currently located.

Mecki
  • 125,244
  • 33
  • 244
  • 253
1

Some additional info, that might be of interest:

  • Using the ip address, one can resolve the hostname, net provider / organization the IP belongs to, and rough geographic location.
  • Using the referer, the list of queries a specified client makes, and a reliable cookie mechanism, one can resolve the path the visitor makes (even clickthroughs to other sides, with AJAX and/or a forwarder page)
  • Using flash, with a combination of AJAX, the mouse location within the browsing window can be captured
  • The User Agent might contain information regarding operation system, installed .NET frameworks, and other curiosities
Silver Dragon
  • 5,480
  • 6
  • 41
  • 73
0

late to the party here, the website can also scan your ports, to find what software you are running!

CuongDC
  • 634
  • 1
  • 7
  • 16
0

.NET framework versions are transmitted in IE, in the User Agent.

Jim Deville
  • 10,632
  • 1
  • 37
  • 47
0
  1. Can the browser support JS
  2. Can the browser support flash
  3. Operating system platform
  4. Screen resolution
  5. Supports CSS
  6. Supports tables
Mitchel Sellers
  • 62,228
  • 14
  • 110
  • 173
  • When you said "flas" did you mean "flash"? HOW does one test for these things? For instance, I've never heard of being able to test whether tables are supported... how on EARTH would one do that? – mcherm Sep 17 '08 at 20:47
  • yes, that was supposed to be flash. SOme of them are being done via JS, and some are items that .NET calculates for you already if using ASP.NET. You can use google to get a good listing of items that you can find. – Mitchel Sellers Sep 17 '08 at 21:11
0

Flash can give you a list of fonts on the user's machine among other things. Javascript can send information when the mouse stops over an ad without clicking it. You can also get the window size, whether the site is open in a frame, if popups or specific plugins have been blocked, looking for Javascript features can tell if the user agent header is correct or faked...

jjrv
  • 4,211
  • 2
  • 40
  • 54
0
  • You can usually determine which language the user speaks through the Accept-Language HTTP header.
  • You can determine whether certain applications and browser plugins are installed by looking at the Accept HTTP header.
  • Browser version/patchlevel and .NET framework version through the User-Agent HTTP header.
  • Your ISP/Employer and geographical location through IP address.
  • Whether or not you have visited particular URLs through CSS and/or timing load events. If a particular website has user-specific URIs, this could disclose whether you are a certain user on that site or not.
  • Which fonts are available through measuring ems and/or Flash.
  • Screen resolution, window size, timezone through JavaScript.
  • Where you move your mouse and keystrokes through JavaScript. For instance, you can see what people type into text boxes even if they don't hit submit.
  • Many UserJS/Greasemonkey scripts leak information (e.g. if you filter out certain people, the sites it is configured for may be able to find out who).
Jim
  • 72,985
  • 14
  • 101
  • 108
0

If you're concerned about your personal security (I'm not sure if that's what you're really getting after, so my apologies if this is misguided), you can always use a Tor network. If you use Firefox, you can use Torbutton for one click enabling. It has the benefit (drawback, to some), of disabling Flash because it's otherwise impossible to protect against Flash information leaks.

Ovid
  • 11,580
  • 9
  • 46
  • 76
0

I need to dig up the link, but if the user is using IE, with common software titles installed, determining which ones are installed is possible.

scunliffe
  • 62,582
  • 25
  • 126
  • 161
0

As far as I know, it's possible to get clipboard data via javascript. Not sure how possible it is by default these days, but it was all the rage not long ago. I do believe IE still allows it.

People have a habit of leaving very important data in their clipboard, so this is pretty bad.

Daniel Bruce
  • 11,269
  • 4
  • 30
  • 28