Invitation to steal my javascript-based password

[molendijk]

Hello dynamicdrivers. Try to steal my password here (mesdomaines.nu/hack_me/hackme.html). Can you do it?

[traq]

yes :)

[molendijk]

That's fast!
I won't ask you yet how you did it, but you may want to give us the first letter of the password.

[traq]

I'll do you one better. PM'd.

[keyboard]

Your guess: _ e _ _ _ _ _. Congratulations. You are a genius.
Took me forever though.

[molendijk]

Well traq and keyboard, since you managed to steal my password, I'll try to do a better job.
One question: did you find it by downloading the files of the site?

[traq]

Technically, since "visiting" a webpage is just another way of saying you downloaded it, yes. But I didn't do anything special (didn't even use view source). Interestingly, I didn't see your onmouseleave event right away because I opened Chrome's dev tools (apparently, Chrome doesn't count switching windows as a mouseleave event :)). Anyway, dev tools showed me everything. You could also find it by disabling javascript and inspecting the script on each page in sequence. Not a bad job, though! Creative approach. Fun exercise.

You could have made it much more difficult by hashing the password instead of leaving it in plain text. There are user implementations of md5 for javascript (http://pajhome.org.uk/crypt/md5), for example. This still wouldn't be "secure," but it would have taken more dedication on the part of the attacker (for instance, I would have told you how to crack it, but probably wouldn't have bothered trying myself).

[molendijk]

Thanks for the useful remarks, traq.
What I actually did was including the page containing the password (password.html) in a div of the main page (=hackme.html) with the help of onhashchange. This ensured that hackme.html always displayed as hackme.html#password.html. I also put a script in password.html ensuring that this was also true for password.html (displaying as hackme.html#password.html too).
Viewing the source of hackme.html#password.html now only produced the actual source of hackme.html, not the source of the file (password.html) containing the password. So I thought I had created some kind of password protection until I discovered that the whole thing didn't work when the visitor downloaded the site. That's where I thought the onmouseleave might be useful. I was not aware of what you said about dev tools.
Thanks a lot. Very helpful.

[traq]

Dev tools almost make "view source" obsolete. Plus, they're in every major browser by default nowadays.

[keyboard]

One question: did you find it by downloading the files of the site?
Personally I just opened the site up in FireBug (an addon for FireFox) and that showed me each of the scripts that were currently running on that page. I was going to try and brute force it, but I couldn't be bothered :p