zlacker

So running untrusted code on your computer is a bad thing. Well, it should be in a sandbox, but that has many intentional and proably some less intentional holes to do stuff on your machine.

So how do I trace what Javascript is doing on my machine?

Generally mitmproxy gives a feeling what sites the browser talks too. And strace gives often a good feeling what a Linux binary does. But the browser is too big and complicated to read strace output in most cases.

Can anybody recommend a tool to look what Javascript code loaded by a certain page is doing?

>>usr110+(OP)
Chrome dev tools? You can step through every JavaScript call

>>usr110+(OP)
>Can anybody recommend a tool to look what Javascript code loaded by a certain page is doing?

Almost all modern browsers have debug panels that will list all of the requests made by a page, assets cached, cookies and local db, and of course it's trivial to just view the source of a site and read the javascript if it isn't compressed.

>>usr110+(OP)
> Can anybody recommend a tool to look what Javascript code loaded by a certain page is doing?

Open your browser's developer tools, go to the Script/Debugger tab and have at it. It's just about as obtuse to use as a tool as gdb, but you'll see exactly what it does. Chrome dev tools has automatic formatting of the code, maybe firefox too. But you'll be stuck with shitty variable names if they been mangled. Although you could try http://www.jsnice.org/, I had variable luck with using it.

It would be interesting to have a browser tool that is like strace and you could filter by calls, so you can see exactly where window.navigator is being used for example, or localStorage.setItem. For now best you can do is searching for "navigator" which works, but can be minified/hidden away by coder as well.

>>krapp+I
Yes, I am aware of dev tools. I use them to look at network requests or to "steal" my own credentials for curl usage.

Haven't really used the Javascript debugger, but my guess would be completely infeasible to follow everything a random "modern" Web site might do. And as you say some Javascript might be compressed or obfuscated. What I really would want is a somewhat higher level / more filtered approach: Like strace lets me just trace file operations for example.

>>capabl+Q
> It would be interesting to have a browser tool that is like strace and you could filter by calls, so you can see exactly where window.navigator is being used for example, or localStorage.setItem.

Exactly, that's what I meant.

>>usr110+y1
I'm not sure if it always works on all APIs or browsers, but you can wrap and replace DOM API objects with logging proxies.

Additionally, you can set breakpoints on event handlers and Chromium has deobfuscation built in. You can usually tell approximately what's going on by stepping through the code and watching the variables in local scope.

>>usr110+S1
Because JavaScript is dynamic, you can often rebind things like window.fetch to trace what’s going on (store the old copy and replace with a new one that does something before delegating). If you can arrange your shim to be loaded before any other JS, I guess you could implement something like object capabilities for JavaScript?

>>TJSome+D5
> but you can wrap and replace DOM API objects with logging proxies.

Right, so you are describing the implementation of the tool I was looking for. Obviously I don't want to do that manually while tracing a page.

>>usr110+S1
Note that javascript can access whether developer tools are open and change it's behaviour. Or so I've heard.