[ADDED] A Surrogate Script for ING Direct and Similar Sites

Bug reports and enhancement requests
Post Reply
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3370
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:
Contact GµårÐïåñ

[ADDED] A Surrogate Script for ING Direct and Similar Sites

Post by GµårÐïåñ »

Giorgio, I was wondering if there is a way to provide a surrogate script for this page code:
NOTE: apparently the forum will not allow me to post the entire code (Your message contains 60770 characters. The maximum number of allowed characters is 60000.) so I am cutting all of it except the actual function in question! I would alternatively attach the code but we can't here.

Code: Select all

...

    <script type="text/javascript"> 
        urchinTracker('/login_pinpad');
    </script> 

...

<div class="loginPadding">
    
<script language='javascript'>
    function checkEnter(e, form) {
        var charCode;
        if(e && e.which) {
            charCode = e.which;
        } else {
            charCode = e.keyCode;
        }
        if (charCode == 13) {
            form.submit();
            return false;
        } else {
            return true;
        }
    }
</script>

...

            <div style="padding: 10px 0px 16px 0px; margin-left:98px;" class="m_pinpad">
            <div id="keyOnly" style="display:none;">
                <div class="keypad">
                        
    <table border="0" cellpadding="0" cellspacing="0">
        <tr valign="top">

                                                                                                                                <td align="right">                                  
                           <img src="https://home.ingdirect.com/images/secure/pinpad/1.gif" class='pinpadbutton' id='pinKeyboardCnumber' onMouseUp='return mouseUpKb("C", 1 , "pinKeyboard")' onMouseDown='return setButtonDownKb(1 , "C", "pinKeyboard")' onMouseOut='return setButtonUpKb(1, "C", "pinKeyboard")' height='32' width='20' alt='1' />                        </td>
                        <td align="left">
                           <img src="https://home.ingdirect.com/images/secure/pinpad/C.gif" class='pinpadbutton' id='pinKeyboardCchar' onMouseUp='return mouseUpKb("C", 1 , "pinKeyboard")' onMouseDown='return setButtonDownKb(1 , "C", "pinKeyboard")' onMouseOut='return setButtonUpKb(1 , "C", "pinKeyboard")' width='17' height='32' alt='C'  />                        </td>
                                        
                                                                                                            <td align="right">                                  
                           <img src="https://home.ingdirect.com/images/secure/pinpad/2.gif" class='pinpadbutton' id='pinKeyboardVnumber' onMouseUp='return mouseUpKb("V", 2 , "pinKeyboard")' onMouseDown='return setButtonDownKb(2 , "V", "pinKeyboard")' onMouseOut='return setButtonUpKb(2, "V", "pinKeyboard")' height='32' width='20' alt='2' />                        </td>
                        <td align="left">
                           <img src="https://home.ingdirect.com/images/secure/pinpad/V.gif" class='pinpadbutton' id='pinKeyboardVchar' onMouseUp='return mouseUpKb("V", 2 , "pinKeyboard")' onMouseDown='return setButtonDownKb(2 , "V", "pinKeyboard")' onMouseOut='return setButtonUpKb(2 , "V", "pinKeyboard")' width='17' height='32' alt='V'  />                        </td>

                                        
                                                                                                            <td align="right">                                  
                           <img src="https://home.ingdirect.com/images/secure/pinpad/3.gif" class='pinpadbutton' id='pinKeyboardHnumber' onMouseUp='return mouseUpKb("H", 3 , "pinKeyboard")' onMouseDown='return setButtonDownKb(3 , "H", "pinKeyboard")' onMouseOut='return setButtonUpKb(3, "H", "pinKeyboard")' height='32' width='20' alt='3' />                        </td>
                        <td align="left">
                           <img src="https://home.ingdirect.com/images/secure/pinpad/H.gif" class='pinpadbutton' id='pinKeyboardHchar' onMouseUp='return mouseUpKb("H", 3 , "pinKeyboard")' onMouseDown='return setButtonDownKb(3 , "H", "pinKeyboard")' onMouseOut='return setButtonUpKb(3 , "H", "pinKeyboard")' width='17' height='32' alt='H'  />                        </td>
                                        
                                            </tr><tr valign="top">
                                                                                                            <td align="right">                                  
                           <img src="https://home.ingdirect.com/images/secure/pinpad/4.gif" class='pinpadbutton' id='pinKeyboardMnumber' onMouseUp='return mouseUpKb("M", 4 , "pinKeyboard")' onMouseDown='return setButtonDownKb(4 , "M", "pinKeyboard")' onMouseOut='return setButtonUpKb(4, "M", "pinKeyboard")' height='32' width='20' alt='4' />                        </td>
                        <td align="left">

                           <img src="https://home.ingdirect.com/images/secure/pinpad/M.gif" class='pinpadbutton' id='pinKeyboardMchar' onMouseUp='return mouseUpKb("M", 4 , "pinKeyboard")' onMouseDown='return setButtonDownKb(4 , "M", "pinKeyboard")' onMouseOut='return setButtonUpKb(4 , "M", "pinKeyboard")' width='17' height='32' alt='M'  />                        </td>
                                        
                                                                                                            <td align="right">                                  
                           <img src="https://home.ingdirect.com/images/secure/pinpad/5.gif" class='pinpadbutton' id='pinKeyboardGnumber' onMouseUp='return mouseUpKb("G", 5 , "pinKeyboard")' onMouseDown='return setButtonDownKb(5 , "G", "pinKeyboard")' onMouseOut='return setButtonUpKb(5, "G", "pinKeyboard")' height='32' width='20' alt='5' />                        </td>
                        <td align="left">
                           <img src="https://home.ingdirect.com/images/secure/pinpad/G.gif" class='pinpadbutton' id='pinKeyboardGchar' onMouseUp='return mouseUpKb("G", 5 , "pinKeyboard")' onMouseDown='return setButtonDownKb(5 , "G", "pinKeyboard")' onMouseOut='return setButtonUpKb(5 , "G", "pinKeyboard")' width='17' height='32' alt='G'  />                        </td>
                                        
                                                                                                            <td align="right">                                  
                           <img src="https://home.ingdirect.com/images/secure/pinpad/6.gif" class='pinpadbutton' id='pinKeyboardRnumber' onMouseUp='return mouseUpKb("R", 6 , "pinKeyboard")' onMouseDown='return setButtonDownKb(6 , "R", "pinKeyboard")' onMouseOut='return setButtonUpKb(6, "R", "pinKeyboard")' height='32' width='20' alt='6' />                        </td>
                        <td align="left">

                           <img src="https://home.ingdirect.com/images/secure/pinpad/R.gif" class='pinpadbutton' id='pinKeyboardRchar' onMouseUp='return mouseUpKb("R", 6 , "pinKeyboard")' onMouseDown='return setButtonDownKb(6 , "R", "pinKeyboard")' onMouseOut='return setButtonUpKb(6 , "R", "pinKeyboard")' width='17' height='32' alt='R'  />                        </td>
                                        
                                            </tr><tr valign="top">
                                                                                                            <td align="right">                                  
                           <img src="https://home.ingdirect.com/images/secure/pinpad/7.gif" class='pinpadbutton' id='pinKeyboardJnumber' onMouseUp='return mouseUpKb("J", 7 , "pinKeyboard")' onMouseDown='return setButtonDownKb(7 , "J", "pinKeyboard")' onMouseOut='return setButtonUpKb(7, "J", "pinKeyboard")' height='32' width='20' alt='7' />                        </td>
                        <td align="left">
                           <img src="https://home.ingdirect.com/images/secure/pinpad/J.gif" class='pinpadbutton' id='pinKeyboardJchar' onMouseUp='return mouseUpKb("J", 7 , "pinKeyboard")' onMouseDown='return setButtonDownKb(7 , "J", "pinKeyboard")' onMouseOut='return setButtonUpKb(7 , "J", "pinKeyboard")' width='17' height='32' alt='J'  />                        </td>
                                        
                                                                                                            <td align="right">                                  
                           <img src="https://home.ingdirect.com/images/secure/pinpad/8.gif" class='pinpadbutton' id='pinKeyboardPnumber' onMouseUp='return mouseUpKb("P", 8 , "pinKeyboard")' onMouseDown='return setButtonDownKb(8 , "P", "pinKeyboard")' onMouseOut='return setButtonUpKb(8, "P", "pinKeyboard")' height='32' width='20' alt='8' />                        </td>

                        <td align="left">
                           <img src="https://home.ingdirect.com/images/secure/pinpad/P.gif" class='pinpadbutton' id='pinKeyboardPchar' onMouseUp='return mouseUpKb("P", 8 , "pinKeyboard")' onMouseDown='return setButtonDownKb(8 , "P", "pinKeyboard")' onMouseOut='return setButtonUpKb(8 , "P", "pinKeyboard")' width='17' height='32' alt='P'  />                        </td>
                                        
                                                                                                            <td align="right">                                  
                           <img src="https://home.ingdirect.com/images/secure/pinpad/9.gif" class='pinpadbutton' id='pinKeyboardWnumber' onMouseUp='return mouseUpKb("W", 9 , "pinKeyboard")' onMouseDown='return setButtonDownKb(9 , "W", "pinKeyboard")' onMouseOut='return setButtonUpKb(9, "W", "pinKeyboard")' height='32' width='20' alt='9' />                        </td>
                        <td align="left">
                           <img src="https://home.ingdirect.com/images/secure/pinpad/W.gif" class='pinpadbutton' id='pinKeyboardWchar' onMouseUp='return mouseUpKb("W", 9 , "pinKeyboard")' onMouseDown='return setButtonDownKb(9 , "W", "pinKeyboard")' onMouseOut='return setButtonUpKb(9 , "W", "pinKeyboard")' width='17' height='32' alt='W'  />                        </td>
                                        
                                            </tr><tr valign="top">
                                                            
                            
                <td colspan="2" align="right">

                  <img src="https://home.ingdirect.com/images/secure/pinpad/clear_keyboard.gif" class='pinpadbutton' onMouseUp='emptyText("pinKeyboard")' height='32' width='37' alt='Clear' />                </td>
                
                <td align="right">
                  <img src="https://home.ingdirect.com/images/secure/pinpad/0.gif" class='pinpadbutton' id='pinKeyboardNnumber'   onMouseUp='return mouseUpKb("N", 0, "pinKeyboard")' onMouseDown='return setButtonDownKb(0, "N", "pinKeyboard")' onMouseOut='return setButtonUpKb(0, "N", "pinKeyboard")' height='32' width='20' alt='zero' />                </td>

                <td align="left">
                  <img src="https://home.ingdirect.com/images/secure/pinpad/N.gif" class='pinpadbutton' id='pinKeyboardNchar'   onMouseUp='return mouseUpKb("N", 0, "pinKeyboard")' onMouseDown='return setButtonDownKb(0, "N", "pinKeyboard")' onMouseOut= 'return setButtonUpKb(0, "N", "pinKeyboard")' width='17' height='32' alt='N'  />                </td>
               <td width="2"></td>
                        
            <td colspan="2">

                            </td>
        </tr>
    </table>
                    <div class="keypadInput">
                                        <input type="password" id="customerAuthenticationResponse.PIN" name="customerAuthenticationResponse.PIN" value=""  tabindex='3' maxlength='11' size='10' autocomplete='off' onKeyPress='return filterInput(event)'>                     </div>
                </div>
            </div>
            <div id="clickOnly" class="clickpad" style="text-align:center;width:130px;">

                    
    <table border="0" cellpadding="0" cellspacing="0">
        <tr valign="top">
                                                                                                                                <td align="right">
                           <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/1.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "C", 1 , "pin")' onMouseDown='return setButtonDownMouse(this, 1 )' onMouseOut='return setButtonUpMouse(this, 1 )' height='34' width='41' alt='1' />                        </td>
                                        
                                                                                                            <td align="right">
                           <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/2.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "V", 2 , "pin")' onMouseDown='return setButtonDownMouse(this, 2 )' onMouseOut='return setButtonUpMouse(this, 2 )' height='34' width='41' alt='2' />                        </td>
                                        
                                                                                                            <td align="right">
                           <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/3.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "H", 3 , "pin")' onMouseDown='return setButtonDownMouse(this, 3 )' onMouseOut='return setButtonUpMouse(this, 3 )' height='34' width='41' alt='3' />                        </td>

                                        
                                            </tr><tr valign="top">
                                                                                                            <td align="right">
                           <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/4.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "M", 4 , "pin")' onMouseDown='return setButtonDownMouse(this, 4 )' onMouseOut='return setButtonUpMouse(this, 4 )' height='34' width='41' alt='4' />                        </td>
                                        
                                                                                                            <td align="right">
                           <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/5.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "G", 5 , "pin")' onMouseDown='return setButtonDownMouse(this, 5 )' onMouseOut='return setButtonUpMouse(this, 5 )' height='34' width='41' alt='5' />                        </td>
                                        
                                                                                                            <td align="right">
                           <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/6.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "R", 6 , "pin")' onMouseDown='return setButtonDownMouse(this, 6 )' onMouseOut='return setButtonUpMouse(this, 6 )' height='34' width='41' alt='6' />                        </td>

                                        
                                            </tr><tr valign="top">
                                                                                                            <td align="right">
                           <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/7.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "J", 7 , "pin")' onMouseDown='return setButtonDownMouse(this, 7 )' onMouseOut='return setButtonUpMouse(this, 7 )' height='34' width='41' alt='7' />                        </td>
                                        
                                                                                                            <td align="right">
                           <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/8.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "P", 8 , "pin")' onMouseDown='return setButtonDownMouse(this, 8 )' onMouseOut='return setButtonUpMouse(this, 8 )' height='34' width='41' alt='8' />                        </td>
                                        
                                                                                                            <td align="right">
                           <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/9.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "W", 9 , "pin")' onMouseDown='return setButtonDownMouse(this, 9 )' onMouseOut='return setButtonUpMouse(this, 9 )' height='34' width='41' alt='9' />                        </td>

                                        
                                            </tr><tr valign="top">
                                                            
                            <td  align="right">
                    <img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/clear.gif" class='pinpadbutton'  onMouseDown='return emptyText("pin")' height='34' width='41' alt='Clear' />                </td>
                
                <td  align="right">
                    <img src="https://home.ingdirect.com/images/secure/nimbus/pinpad/0.gif" class='pinpadbutton' width='41' height='34' alt='zero'   onMouseDown='return setButtonDownMouse(this, 0)' onMouseOut= 'return setButtonUpMouse(this, 0)' onMouseUp='return mouseUpMouse(this, "N", 0, "pin")' />               <td width="2"></td>
                        
            <td colspan="2">
                            </td>
        </tr>

    </table>
                <div style="margin:0 10px 0 0;height:25px;" id="pinball"><!-- --></div>
            </div>
        </div>
                        </div>
        <div class="bl"></div>
        <div class="bc" style="width: 315px;"></div>
        <div class="br"></div>
    </div>

    </div>
</div>

<div id="keyboardMessage" class="smallerText" style="padding:10px 0 0 0;width:202px;float:left;display:none">
    <a href="#" class="orangeLink" onClick="togglePinPads(true);" tabindex="4" style="font-size:11px;">Return</a> to the <strong>NUMBERS</strong> only PINpad.
</div>
<div id="clickMessage" class="smallerText" style="padding:10px 0 0 0;width:202px;float:left; clear:none; ">
    If you're unable to use your mouse, you may also use your <a class="orangeLink" href="#" onClick="togglePinPads(false);" tabindex="3" style="font-size:11px;">keyboard</a>.

</div>
<div style="float:left; clear:none;padding:10px 0 0 19px!important;">
    <a href="#" class="transBtn" id="continueButton" name="continueButton" title="Continue" tabIndex="5" onClick="callUrchinPathTracker('/signIn/', 'pinpad/continue');submitForm();"><div style="text-decoration:none;">Continue</div></a>
</div>

</div>        </div>

          <input type="hidden" name="riskBasedAuthorizationResults" value="" id="riskBasedAuthorizationResults"/>
    </form>

<!-- Risk Based Assessment -->
   <script type="text/javascript" src='https://www.advanced-web-analytics.com/70012/splash.js'></script>

...
The continue button that validates and submits the pin to the signin page processor so that you can proceed is inline trapped inside an URCHIN function for tracking (onClick="callUrchinPathTracker('/signIn/', 'pinpad/continue');submitForm();") and the only way to bypass this restriction is to allow globally on NoScript, turn off AdBlock, allow all requests on RequestPolicy, and turn off blocking in Ghostery, effectively turning off ALL the security measures of security. Of course, alternatively you can just blanket whitelist ING in all of those applications which effectively means that you won't be able to bypass the tracking and/or use ABE rules which will also require the global whitelisting of the site and rule based restrictions instead. Either way you go, you are giving them the information they want and I want a way to facilitate the function but cripple the payload. My hope is that a surrogate script can trick ING into thinking all the security is off and still nullify the tracking and provide the needed continue function.

Doable? Ideas? Thanks in advance.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/6.0 (en-US; rv:6.9.6.9) Gecko/66666666 Firefox/6.6.6
Top
User avatar
therube
Ambassador
Posts: 7969
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: A Surrogate Script for ING Direct and Similar Sites

Post by therube »

(pastebin or similar)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100915 Firefox/4.0b7pre SeaMonkey/2.1b1pre
Top
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:
Contact Giorgio Maone

Re: A Surrogate Script for ING Direct and Similar Sites

Post by Giorgio Maone »

Could you try:

Code: Select all

user_pref("noscript.surrogate.ing.sources","@*.ingdirect.com");
user_pref("noscript.surrogate.ing.replacement","addEventListener('DOMContentLoaded',function(){callUrchinPathTracker=function(){}},false)");
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Top
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3370
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:
Contact GµårÐïåñ

Re: A Surrogate Script for ING Direct and Similar Sites

Post by GµårÐïåñ »

You are beautifully awesome my friend, it works perfectly like a charm and without allowing ANYTHING. So please go ahead and confidently include that surrogate in the package for all to enjoy because it works and I am sure many will enjoy it without even realizing it. Thank you again.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/6.0 (en-US; rv:6.9.6.9) Gecko/66666666 Firefox/6.6.6
Top
Post Reply

Return to “NoScript Development”