How to Reveal Saved Browser Passwords with JavaScript Injections

JavaScript is the language of the internet. It is what allows us to create dynamic, interesting webpages that are fast, web-based applications and so much more. The primary use of JavaScript is to write functions that are embedded in or included from HTML pages and that interact with the Document Object Model (DOM) of the page. This is the magic that allows all of what we see to happen, and for our browser to be manipulated.

What Is JavaScript Used For?

• Pop up windows. A new window with programmatic control over the size, position, and attributes.
• Validating input values of a web form to make sure that they are acceptable before being submitted to the server.
• Changing images as the mouse cursor moves over them in real-time.
• Creating cookies to save important browser information.
• Saving browser preferences.
• Entire browser webkits.
• Anonymous redirects.
• Real-time website changes.
• Command execution based on chronology.
• Many more.

As you can see, JavaScript controls a lot of what we see on the internet. However, since it can also control our browser at such a low level, we can manipulate forms and webpages to do things that they weren't normally intended for. Today in Null Byte, we are going to do a cool, quick JavaScript hack that can reveal browser passwords that are stored by manipulating the browser.

The Code

Paste this code into the URL field in your browser to reveal stored passwords (you must be at a website the shows the asterisks on the screen):

javascript: var p=r(); function r(){var g=0;var x=false;var x=z(document.forms);g=g+1;var w=window.frames;for(var k=0;k

Now, as a fun little game, who can tell me why it does it? Leave comments in the forums! Also, come say hi on Twitter and in the IRC! We have loads of new members who idle frequently.

Photo by Freddy The Boy