├── README.md
├── index.html
└── attack.js


/README.md:
--------------------------------------------------------------------------------
 1 | ### devtools presence detector
 2 | ##### (chrome and firefox, latest versions only)
 3 | 
 4 | This is a PoC timing attack of detecting if devtools are open or not on web browsers. It exploits the fact that slow code is generated by the JS VM when a debugger is present.
 5 | 
 6 | Live demo at: <http://awal.js.org/devtools-timing-attack>
 7 | 
 8 | #### License
 9 | 
10 | WTFPL
11 | 
12 | #### Author
13 | 
14 | Awal Garg
15 | 


--------------------------------------------------------------------------------
/index.html:
--------------------------------------------------------------------------------
 1 | <title>devtools presence detector</title>
 2 | <h3>devtools presence detector</h3>
 3 | <h5>(chrome and firefox, latest versions only)</h5>
 4 | <p>See working/Fork/Star on Github: <a href="https://github.com/awalGarg/devtools-timing-attack">https://github.com/awalGarg/devtools-timing-attack</a></p>
 5 | 
 6 | <p>Made by <a href="https://twitter.com/awalGarg">@awalGarg</a></p>
 7 | 
 8 | <hr>
 9 | 
10 | <pre id="res" style="font-size: 130%">loading...</pre>
11 | <pre id="change"></pre>
12 | <pre id="debug"></pre>
13 | <script src="./attack.js"></script>
14 | 


--------------------------------------------------------------------------------
/attack.js:
--------------------------------------------------------------------------------
 1 | ff = (navigator.userAgent.indexOf('Firefox') !== -1);
 2 | timeLimit = ff ? 5 : 2;
 3 | varLimit = ff ? 2 : 3;
 4 | iterations = 20;
 5 | lastRun = null;
 6 | function run() {
 7 | 	iterations = +iterations;
 8 | 	took = (
 9 | 		Array(iterations)
10 | 			.fill(0)
11 | 			.map(collect)
12 | 			.reduce(function(a, b) { return a+b; }, 0)
13 | 	) / iterations;
14 | 	if (location.search.indexOf('debug') !== -1) {
15 | 		debug.appendChild(document.createTextNode(`\n\ntook ${took} ms on average`));
16 | 	}
17 | 	return took;
18 | }
19 | 
20 | function collect(_, i) {
21 | 	var start = performance.now();
22 | 	heavyTask(i);
23 | 	var end = performance.now();
24 | 	return end - start;
25 | }
26 | 
27 | function heavyTask(arg) {
28 | 	var buffer = [];
29 | 	for (var i = 0; i <= arg; i++) {
30 | 		var el = document.createElement('script');
31 | 		el.textContent = 'console.log(' + i + ')';
32 | 		document.head.appendChild(el);
33 | 		buffer.push(el);
34 | 	}
35 | 	for (var i = 0; i <= arg; i++) {
36 | 		document.head.removeChild(buffer[i]);
37 | 	}
38 | }
39 | 
40 | if (!('fill' in [])) {
41 | 	Array.prototype.fill = function(val) {
42 | 		for (var i = 0; i < this.length; i++) {
43 | 			this[i] = val;
44 | 		}
45 | 		return this;
46 | 	};
47 | }
48 | 
49 | (function check() {
50 | 	var val = run();
51 | 	if (val > timeLimit) {
52 | 		res.textContent = 'Y U NO CLOSE DEVTOOLS!!';
53 | 	} else {
54 | 		res.textContent = 'if you open devtools, I would know and this text would change :)';
55 | 	}
56 | 	setTimeout(check, 500);
57 | })();
58 | 


--------------------------------------------------------------------------------