Javascript Web Browser Fingerprinting

[Siento la parrafada en ingles si sueles leer este blog en español pero el tema a tratar requiere que use la lengua inglesa para alcanzar a la mayor audiencia posible / If it's your first time reading me, understand that I'm from Spain and english isn't my primary language]

The Javascript Web Browser Fingerprinting is a web browser error-based technique that can tell us what is the browser that someone is using without checking his (probably) User Agent modified value.

The main goal of this technique can be detect real browsers to launch concrete exploits to the visitor of a malware website but it can be used to make more accurate visitors stats reports too.

In the PoC that I made I’m base on two different errors types. First of all I try to access with an XMLHttpRequest to the about:blank page, who has to be denied from the navigator render engine. It causes a different exception in every navigator engine and parsing the error code I’m able to determine between major versions of web browsers.

Actually with this code I can detect these browsers:

• Mozilla Firefox 2.0
• Mozilla Firefox 3.0
• Internet Explorer 7.0+
• Internet Explorer 6.0
• Opera 9.50+
• Safari 3
• Google Chrome

At the code you will see I’m doing a try catch block who parses the exception object message when it’s a version of Mozilla Firefox, Opera, Safari or Google Chrome. It’s because doesn’t mind which is your language of your browser, they will throw internally an English error and I can parse it.

If we start to talk about Internet Explorer versions we have to move to special properties of the exception object because they use a localized error message, but IE has some properties that other browsers doesn’t have, so I can use it to determine IE version.

When two browsers have the same navigator engine (like Safari and Chrome) I do another approach to determine which browser is it. Its base on error launched when a variable isn’t defined in a Javascript code and how the different browsers threat it.

I was working (and I’m currently doing too, Mozilla Firefox 3.1 will be the next) at this idea from early June of this year and I was waiting too long to publish because I was waiting that it was approved at Conferencia Ibero-Americana WWW/Internet 2008. At the date I started working of this I couldn’t find any information about this at internet, but this week I found that in the next release of Metasploit they are going to introduce a similar approach to the idea.

As you can see at the SVN they publish a code that made some similar tricks like I do but with some differences. This code only detects Firefox and IE but all of this in a more accurate version approach because they are focused in the exploits they have, but in the last lines of code they use the navigator object, something that I’m trying to avoid. I think I’ll be great to combine both codes to make a more powerful Javascript Web Browser Fingerprinting.