In the first part, we explained the theoretical principles of Browser Fingerprinting. In this part, we will realize a concept-proof application to demonstrate the principle.
Table of Contents
Running the Experiment
We will, therefore, run a website that will collect browser information. We choose to code the server-side in PHP. Our probes will collect information about the browser on parallel and upload the information to the server-side.
Headers Analyze (PHP)
The function AnalyzeHeaders will process the headers sent by the browser (user-agent etc…)
We use javascript to collect primary information about plugins and micro-versions of the plugins. Most of the information is obtained through the navigator object.
function getNavInfos()
{
var plugs="<table border='1'><tr><th>plug-in name</th><th>description</th><th>filename</th></tr>";
var plug2="";
for(i=0;i<navigator.plugins.length;i++)
{
plugs=plugs+"<tr id='description'><td>"+navigator.plugins[i].name+"</td><td>"+navigator.plugins[i].description+"</td><td>"+navigator.plugins[i].filename+"</td></tr>";
plug2=plug2+"[PLUGIN NAME="+navigator.plugins[i].name+"][PLUGIN DESCRIPTION="+navigator.plugins[i].description+"][PLUGIN FILENAME="+navigator.plugins[i].filename+"])";
//level2 mime types
var nav2=navigator.plugins[i];
if(nav2.length != null)
{
for(j=0;j<nav2.length;j++)
{
if((nav2[j].type!=null)&&(nav2[j].description!=null))
{
plugs=plugs+"<tr><td>"+nav2[j].type+"</td><td>"+nav2[j].description+"</td><td>"+nav2[j].suffixes+"</td></tr>";
plug2=plug2+"([mime type="+nav2[j].type+"][mime description="+nav2[j].description+"][mime suffixes="+nav2[j].suffixes+"])";
}
}
}
}
plugs=plugs+"</table>";
var language=navigator.language;
var product=navigator.product;
var mimeTypes=null;
var appVersion=navigator.appVersion;
var plugins=plug2;
var onLine=navigator.onLine;
var platform=navigator.platform;
var vendor=navigator.vendor;
var appCodeName=navigator.appCodeName;
var cookieEnabled=navigator.cookieEnabled;
var geolocationEnabled=((navigator.geolocation==null)?"false":"true");
var appName=navigator.appName;
var productSub=navigator.productSub;
var userAgent=navigator.userAgent ;
var vendorSub=navigator.vendorSub;
var test_success=1;
if(product==null)
{
test_success=0;
}
//post to sql
if (typeof console == "undefined") var console = { log: function() {} };
jQuery.post("test_result_sql.php", { testname: 'navigator_javascript' , test_success: test_success , var_language:language , var_product:product , var_mimeTypes:mimeTypes , var_appVersion:appVersion , var_plugins:plugins , var_onLine:onLine , var_platform:platform , var_vendor:vendor , var_appCodeName:appCodeName , var_cookieEnabled:cookieEnabled , var_geolocationEnabled:geolocationEnabled , var_appName:appName , var_productSub:productSub , var_userAgent:userAgent , var_vendorSub:vendorSub , uuid:window.uuid},function( data ) {
Tracer("test navigator javascript post:"+ data,1,window.uuid);
} );
//alert(plugs);
return "language="+navigator.language+"<br>"+
"product="+navigator.product+"<br>"+
"mimeTypes="+navigator.mimeTypes+"<br>"+
"appVersion="+navigator.appVersion+"<br>"+
"plugins="+plugs+"<br>"+
"onLine="+navigator.onLine+"<br>"+
"platform="+navigator.platform+"<br>"+
"vendor="+navigator.vendor+"<br>"+
"appCodeName="+navigator.appCodeName+"<br>"+
"cookieEnabled="+navigator.cookieEnabled+"<br>"+
"geolocation Enabled="+((navigator.geolocation==null)?"false":"true")+"<br>"+
"appName="+navigator.appName+"<br>"+
"productSub="+navigator.productSub+"<br>"+
"userAgent="+navigator.userAgent +"<br>"+
"vendorSub="+navigator.vendorSub+"<br>";
}
function getNavInfosTXT()
{
plugs="";
for(i=0;i<navigator.plugins.length;i++)
{
plugs=plugs+"decription="+navigator.plugins[i].name+",name="+navigator.plugins[i].description+",filename="+navigator.plugins[i].filename+"%";
//level2 mime types
var nav2=navigator.plugins[i];
if(nav2.length != null)
{
for(j=0;j<nav2.length;j++)
{
if((nav2[j].type!=null)&&(nav2[j].description!=null))
{
plugs=plugs+",type="+nav2[j].type+",description="+nav2[j].description+",suffixes="+nav2[j].suffixes+",";
}
}
}
}
//alert(plugs);
return "language="+navigator.language+"<br>"+
"product="+navigator.product+"<br>"+
"mimeTypes="+navigator.mimeTypes+"<br>"+
"appVersion="+navigator.appVersion+"<br>"+
"plugins="+plugs+"<br>"+
"onLine="+navigator.onLine+"<br>"+
"platform="+navigator.platform+"<br>"+
"vendor="+navigator.vendor+"<br>"+
"appCodeName="+navigator.appCodeName+"<br>"+
"cookieEnabled="+navigator.cookieEnabled+"<br>"+
"geolocation Enabled="+((navigator.geolocation==null)?"true":"false")+"<br>"+
"appName="+navigator.appName+"<br>"+
"productSub="+navigator.productSub+"<br>"+
"userAgent="+navigator.userAgent +"<br>"+
"vendorSub="+navigator.vendorSub+"<br>";
}
Javascript will run a certain amount of checks. For example, it can detect the OS version:
function os_test(uuid)
{
try{
var os_js_test_success=1;
var os_js=null;
if (typeof BrowserDetect == "undefined")
{
os_js_test_success=0;
os_js=null;
}else if(BrowserDetect.OS==null)
{
os_js_test_success=0;
os_js=null;
}
else
{
os_js=BrowserDetect.OS;
window.document.getElementById('OS').innerHTML=os_js;
}
jQuery.post("test_result_sql.php", { testname: 'os_javascript' , test_success: os_js_test_success ,os:os_js, uuid:uuid},function( data ) {
Tracer("test os javascript post:"+ data,1,window.uuid);
} );
}
catch(err)
{
Tracer(err.description,3,window.uuid);
}
}
Our javascript probes can also detect the information related to the screen:
Once all our probes are coded and the “glue” between the plug-ins, javascript and PHP have been created, we run our experiment, we gather and collect visitor’s IPs, geolocation and browser fingerprint in a SQL database.
Here is an example of the computation of a browser fingerprint:
Conclusion: When running the experiment, we did not found so far duplicated fingerprint and we were able to identify returning visitors who had changed just a few parameters, showing how flexible the fingerprint was. It demonstrates that tracking cookies are not necessarily needed to uniquely identify visitors. Such techniques should be taken seriously because they have very strong implications in terms of privacy.
Annex 1: full link for project code source download:
Acodez is a leading website design and web development company in India. We offer all kinds of web design and web development services to our clients using the latest technologies. We are also a top digital marketing agency providing SEO, SMM, SEM, Inbound marketing services, etc at affordable prices. For further information, please contact us.
Looking for a good team
for your next project?
Contact us and we'll give you a preliminary free consultation on the web & mobile strategy that'd suit your needs best.
Jamsheer K, is the Tech Lead at Acodez. With his rich and hands-on experience in various technologies, his writing normally comes from his research and experience in mobile & web application development niche.
