CODEWITHSUNDEEP
javascriptsecuritywebinjectweb-inspector
John
John

Reputation: 83

Can website owner see what client run in console?

I have a refresh script, which clicks automatically in every 5 second on a button. It looks something like this:

setInterval(function() {
  document.getElementsByClassName("buttonclass")[0].click();
}, 5000);

If I put this script into inspect element/console and I run it can the website owner see it? Can the owner of the site watch what kind of scripts is running in console, which was injected by user/client to the website? If yes, how can the owner of the website see it?

Upvotes: 1

Views: 2300

Answers (3)

LeeLenalee
LeeLenalee

Reputation: 31371

As far as I know you cant directly see if a user is inputting and using the developer console, that said if you click a button every 5 seconds you could detect that kind of behaviour. So directly you cant see what and if people input thigns in the dev console but indirect you can in some cases

Upvotes: 1

Ivar
Ivar

Reputation: 6848

JavaScript doesn't provide an API that allows web pages to view everything that is going on in the Console. So to answer the question in your title: no, that is not possible. At least, not directly.

Theoretically there are plenty of ways to detect if specific code is ran. For instance, you can wrap the native setInterval function and sent some AJAX request to the server when someone triggers it.

Here is a small example:

(function() {
  const nativeSetInterval = window.setInterval;
  window.setInterval = (...args) => {
    console.log("Someone ran the setInterval function...");
    nativeSetInterval(...args);
  }
})();
Open the console, be sure to select the right (stacksnippets.net) frame, and execute <code>setInterval<code>.

<code>setInterval(() => console.log('I run every second.'), 1000);</code>

This is however very unlikely to be the case. What is more likely, is that clicking that button triggers some call to the server of the website, which has some logging. If the logging shows that some action is performed exactly every 5 seconds for an extended period of time, they will easily come to the conclusion that it wasn't done manually.

Upvotes: 1

fabian
fabian

Reputation: 158

I probably think the answer here is "it depends on what you do, but usually not". You can talk about these things for hours but put simply: when you "go" to a website you make a HTTP-Request to a web-server which responds with all kinds of data. Your browser uses this data to render the website. The changes you make, or running scripts, etc., happens in your browser. If you change a buttons background-color for example, this change only happens at your machine. But technically speaking, a website could be coded in a way, that every change to the DOM is going to be reported back to the backend (for example via fetch), so it is possible that, for example, a website could track how many times in a second you press a button or something like that. The things you enter in the console though, unless its not interacting with the DOM or any other script, can never be read by the owner, because it has nothing to do with the website, but with your browser (for example, if you type "1+1" in the console, the owner isn't going to see that).

Apart from the fact that it is somewhat technically possible to track some, but not all activity or changes a user makes to a website, by default, if not coded that way, the owner of the website can't see what you are doing with the version of the website that you requested.

Upvotes: 1

Related Questions