Ryan's "How to make your browser LIE like a RUG" page...

amazingly, an update! march 5, 2001:

please note: this page is *several years* old...

maybe someday I'll bother to update it, and the topic about which it speaks... meanwhile, know that browsers have become much more whiz-bang since this was written, and much of the specifics don't work for new browsers.

now featuring switcheroos for:
mac netscape - lynx - Xwindows mosaic - Win95 Netscape - general webform coming soon!
**note** this page is getting old, and the versions of software are kind of out of date... the concepts discussed are still useful, though.

So you'd like to check out all the cool sites that require you to pay unless you use Microsoft Internet Explorer? Well, you could steal a page from Explorer's book, and make your browser tell fibs...
(MSIE already claims it's "mozilla", and it used to let you enter whatever you wanted in the preferences)

Your browser sends a string called the "user agent" that tells servers what kind of beastie it is... but it doesn't have to tell the truth!

this page isn't about getting around user access... it's about faking USER_AGENT. That's "what brand of browser you're using." If you want to fake a username/password for a site, you're on your own. If you email me asking to see porn for free, i'll likely mail you a .gif of my ass.
You can see what your HTTP_USER_AGENT is, among other things, by going to my test page.

NOTE : I've gotten some comments from some people either asking "why do this?", or something to the effect of "fight the power!"... to which I respond:

The purpose of this little exercise is NOT to defraud anyone out of anything.
It's simply an educational experiment.  Just like some people don't want anyone
to see their identity online, or have "cookies" written to their disks, some
don't see how it's anyone on the other end's business what browser one's using,
or would like to look at a page that a server decides won't look good on their 

It's also a caution to anyone who assumes that what a computer is telling you 
is always true.  There's ways to verify that you (or your browser) are "special", but
using a trivial USER_AGENT check isn't a very good way...

Over coffee tonight, a friend and I came upon what we think *is* a pretty 
good way...how about something like unix's "crypt" funtion, implemented as 
a javascript function, except that every browser's "java-s-crypt" function 
is different?  So the page spits a random word at 'ya and then knows what to 
expect back, but *we* don't?   

Any Netscape or MS programmers reading this?  does this exist already? 
(if you don't understand what I just said, don't worry about it...if I'm 
confused, please tell me :)

first target -- making your Mac Netscape look like MSIE 3.0 for Power PC:

if you want to look like you're running win95, just use the string

Mozilla/2.0 (compatible; MSIE 3.01; Windows 95)

Note that you have to split out the "Mozilla", the "2.0" and the rest on separate lines... they're concatenated together by the program.

Note also, that to fool these sites, punctuation, spaces and CaPiToliZation are important...

target two -- turning Lynx over to the "dark side":

"MAN! that was easy!"  -- me

Well, when I set out to hack the source to Lynx, i found out that the newest source (2.6) has it in there already... if you use option "O" to change your options, one of the things you can change is "user agent"...

Change it to something like:

mozilla (compatible; MSIE 3.0; Mac_PowerPC)

and away you go...(note: this only works in 2.6, i think, but no sense in re-compling old source, so ask your admin to install the new lynx! Your milage may vary.)

target three -- interactive cheating:

in the works is a web form that basically asks for a URL, and when you submit it, it goes out, lies to the MS-only server, and gets you the html, then spits it to your non-MSIE browser.

(...kind of like having your older brother buy you beer when you were only 20, except without the $20 surcharge, and it won't tell mom.)

check back in a few days for that... i've gotta take care of some work, and get over this flu first.

**new flash** -- if I set up a server like this, it'll probably get blocked so fast, my head'll spin, so that's most likely out. I'll release the perl source of that CGI though... y'all can roll your own.

New developments:

Mosaic *for UNIX Xwindows only* (as far as I know, this feature isn't included in any mac or PC version of NCSA Mosaic) has spoofing built into the newest version (2.7b4). It'll let you say you're whatever you wanna be. If you're using Mosaic 2.7b4 for Xwindows, go here for a help file.

NEW..."the hack" for win95

yesterday, I wrote:
I'm getting tons of email from people asking for a hack for Win95... Some of these
 people are super anti-Microsoft folk.  
I don't quite get this, but hey...different strokes for different folks.
A hack for the win95/NT version of Netscape is probably going to take a Hex
Editor of some sort, and some pretty detailed instructions, unless I can whip
up a program to go in and do the dirty work for you.

Anyway... I don't have a win95 pc at home, so it'll be a while 'till I can play
with that.  If you have a patch already, email me, and I'll link to ya.

hey.... ask, and ye shall receive (email, anyway...)

Weld Pond over at the l0pht sends this:

 I have been running my WinNT Navigator masquerading as MSIE for a while
 now.  I thought I would let you know how to do the switch so that you
 could put it on your page.
 Use a program that has a resource editor. I use Microsoft's Developer 
 Studio (ah, the sweet justice). Open up the Netscape.exe file and then
 view the strings resource.  Find string #61231.  It has the version number
 in it.  Mine had "3.01b1".  Change this to
 "2.0 (compatible; MSIE 3.01; Windows 95)"
 Also put about 100 spaces after the closing parenthesis.  This is
 necessary because Netscape tries to tack the OS and platform type after
 this string.  The 100 spaces push that info so far out the web servers
 can't read it.
 Now save the file and run.  Works like a charm.  Different versions of 
 Netscape may have the version number at a different resource number but
 you should be able to find it.

...so now you know. Probably later today, I'll dig around for a resource editor for win95 that's freely downloadable, as i don't suppose most folks don't have access to Developer Studio.

thanks, Mr. Pond!

Ugh. Publicity.

Well, now i'm an industrious hacker known only as "Ryan". Rose Aguilar at C|net is a pretty nice person, for respecting my request that I keep a (very) little anonymity, though... thanks, Rose. Apparently this thing was mentioned on Bloomberg Radio, too. Hi, Mom!

The other press this got was from Dave Garaffa, at BrowserWatch. Dave's got a really good point:
there's a reason your browser says who it is... if you don't need to change it, then it's probably best to just keep it like it is. If you go around with a user_agent field that says

"Bond (james bond; 007; UK)", 

you'll probably get more hassle from servers than you wanted. And for those people with foul-mouthed browsers... uh, hello?!? You live to entertain people who read server logs?

Actually, this whole thing started when I was writing some software that
would respond to search robots differently than to "normal browsers"...so
I made Netscape claim to be a search robot so I could test it.
You see, I really had a good reason...but i didn't wanna look like a 
search-bot _all_ the time (especially at parties...)
anyway, if you're one of those die-hard Mac people, (or a proud "Amigan" or whatever) , then realize that if you change your Browser line, then your team no longer gets a checkmark in the [MARKET SHARE] column.

some sites that think they're soooo smart:

The Wall Street Journal
ESPN's SportsZone

comments? email me! hackmsie@ryan.net