From 9668fbb2c86eac44e18ffd77c673d13d160745ea Mon Sep 17 00:00:00 2001 From: Thorin-Oakenpants Date: Wed, 18 Sep 2019 16:27:27 +0000 Subject: [PATCH] Updated Appendix A Test Sites (markdown) --- Appendix-A---Test-Sites.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Appendix-A---Test-Sites.md b/Appendix-A---Test-Sites.md index 069cdd9..bc175cd 100644 --- a/Appendix-A---Test-Sites.md +++ b/Appendix-A---Test-Sites.md @@ -54,7 +54,7 @@ These are good sources to grab information on your results in one hit, but **do * Article: https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/ - [CSS Exfil Vulnerability](https://www.mike-gualtieri.com/css-exfil-vulnerability-tester) - **h**ttps://www.mike-gualtieri.com/css-exfil-vulnerability-tester * [CSS Keylogger with no CSP](https://no-csp-css-keylogger.badsite.io/) - **h**ttps://no-csp-css-keylogger.badsite.io/ -- [CSS History Leak](http://lcamtuf.coredump.cx/yahh/) 1 - **h**ttp://lcamtuf.coredump.cx/yahh/ +- [CSS History Leak](https://earthlng.github.io/testpages/visited_links.html) 1 - **h**ttps://earthlng.github.io/testpages/visited_links.html - CSS Media: disable JS, resize the browser with the tests open * [@media window size leak](https://demos.traudt.xyz/css/media/index.html) - **h**ttps://demos.traudt.xyz/css/media/index.html * [screen & inner window measurements](https://arthuredelstein.github.io/tordemos/media-query-fingerprint.html) - **h**ttps://arthuredelstein.github.io/tordemos/media-query-fingerprint.html @@ -74,7 +74,7 @@ These are good sources to grab information on your results in one hit, but **do - [rel=noopener](https://mathiasbynens.github.io/rel-noopener/) - **h**ttps://mathiasbynens.github.io/rel-noopener/ - [WebRTC](https://browserleaks.com/webrtc) - **h**ttps://browserleaks.com/webrtc -1 This test is a PoC (proof of concept). You will need `layout.css.visited_links_enabled` set as `true`. You will also need a normal window (not a Private Browsing one). The PoC only covers a handful of sites, and many of those will not "leak" as the code is checking HTTP and the site has moved to HTTPS - i.e the full URL has changed. For best results: +1 This test is a PoC (proof of concept). You will need `layout.css.visited_links_enabled` set as `true`. You will also need a normal window (not a Private Browsing one). The PoC only covers a handful of sites. For best results: * Open a normal window in a vanilla Firefox. Clear everything (Ctrl-Shift-Del). - * Go to http://www.cnn.com/ and http://www.foxnews.com/ - * Go to the [test page](http://lcamtuf.coredump.cx/yahh/) and play a game (takes 30 seconds or so) + * Go to some of the sites in the source: e.g. https://www.cnn.com/ and https://www.foxnews.com/ + * Go to the [test page](https://earthlng.github.io/testpages/visited_links.html) and play a game (takes 30 seconds or so)