mac netscape - lynx - Xwindows mosaic - Win95 Netscape - general webform coming soon!
**note** this page is getting old, and the versions of software are kind of out of date... the concepts discussed are still useful, though.
So you'd like to check out all the cool sites that require you to pay unless you use Microsoft Internet Explorer? Well, you could steal a page from Explorer's book, and make your browser tell fibs...
(MSIE already claims it's "mozilla", and it used to let you enter whatever you wanted in the preferences)
Your browser sends a string called the "user agent" that tells servers what kind of beastie it is... but it doesn't have to tell the truth!
this page isn't about getting around user access... it's about faking USER_AGENT. That's "what brand of browser you're using." If you want to fake a username/password for a site, you're on your own. If you email me asking to see porn for free, i'll likely mail you a .gif of my ass.
You can see what your HTTP_USER_AGENT is, among other things, by going to my test page.
NOTE : I've gotten some comments from some people either asking "why do this?", or something to the effect of "fight the power!"... to which I respond:
The purpose of this little exercise is NOT to defraud anyone out of anything. It's simply an educational experiment. Just like some people don't want anyone to see their identity online, or have "cookies" written to their disks, some don't see how it's anyone on the other end's business what browser one's using, or would like to look at a page that a server decides won't look good on their screen. It's also a caution to anyone who assumes that what a computer is telling you is always true. There's ways to verify that you (or your browser) are "special", but using a trivial USER_AGENT check isn't a very good way...Over coffee tonight, a friend and I came upon what we think *is* a pretty good way...how about something like unix's "crypt" funtion, implemented as a javascript function, except that every browser's "java-s-crypt" function is different? So the page spits a random word at 'ya and then knows what to expect back, but *we* don't? Any Netscape or MS programmers reading this? does this exist already? (if you don't understand what I just said, don't worry about it...if I'm confused, please tell me :)
first target -- making your Mac Netscape look like MSIE 3.0 for Power PC:
if you want to look like you're running win95, just use the string
Mozilla/2.0 (compatible; MSIE 3.01; Windows 95) Note that you have to split out the "Mozilla", the "2.0" and the rest on separate lines... they're concatenated together by the program.
Note also, that to fool these sites, punctuation, spaces and CaPiToliZation are important...
target two -- turning Lynx over to the "dark side":
"MAN! that was easy!" -- me
Well, when I set out to hack the source to Lynx, i found out that the newest source (2.6) has it in there already... if you use option "O" to change your options, one of the things you can change is "user agent"...
Change it to something like:
target three -- interactive cheating:
in the works is a web form that basically asks for a URL, and when you submit it, it goes out, lies to the MS-only server, and gets you the html, then spits it to your non-MSIE browser.
(...kind of like having your older brother buy you beer when you were only 20,
except without the $20 surcharge, and it won't tell mom.)
**new flash** -- if I set up a server like this, it'll probably get blocked so fast, my head'll spin, so that's most likely out. I'll release the perl source of that CGI though... y'all can roll your own.
New developments:
Mosaic *for UNIX Xwindows only* (as far as I know, this feature isn't included in any mac or PC version of NCSA Mosaic) has spoofing built into the newest version (2.7b4). It'll let you say you're whatever you wanna be. If you're using Mosaic 2.7b4 for Xwindows, go here for a help file.
NEW..."the hack" for win95
yesterday, I wrote:I'm getting tons of email from people asking for a hack for Win95... Some of these people are super anti-Microsoft folk. I don't quite get this, but hey...different strokes for different folks. A hack for the win95/NT version of Netscape is probably going to take a Hex Editor of some sort, and some pretty detailed instructions, unless I can whip up a program to go in and do the dirty work for you. Anyway... I don't have a win95 pc at home, so it'll be a while 'till I can play with that. If you have a patch already, email me, and I'll link to ya.
hey.... ask, and ye shall receive (email, anyway...)
Weld Pond over at the l0pht sends this:
I have been running my WinNT Navigator masquerading as MSIE for a while now. I thought I would let you know how to do the switch so that you could put it on your page. Use a program that has a resource editor. I use Microsoft's Developer Studio (ah, the sweet justice). Open up the Netscape.exe file and then view the strings resource. Find string #61231. It has the version number in it. Mine had "3.01b1". Change this to "2.0 (compatible; MSIE 3.01; Windows 95)" Also put about 100 spaces after the closing parenthesis. This is necessary because Netscape tries to tack the OS and platform type after this string. The 100 spaces push that info so far out the web servers can't read it. Now save the file and run. Works like a charm. Different versions of Netscape may have the version number at a different resource number but you should be able to find it.
...so now you know. Probably later today, I'll dig around for a resource editor for win95 that's freely downloadable, as i don't suppose most folks don't have access to Developer Studio.
thanks, Mr. Pond!
Ugh. Publicity.
Well, now i'm an
industrious hacker known only as "Ryan". Rose Aguilar at C|net is a pretty nice
person, for respecting my request that I keep a (very) little anonymity, though...
thanks, Rose. Apparently this thing was mentioned on Bloomberg Radio, too. Hi,
Mom!
The other press this got was from Dave Garaffa, at
BrowserWatch. Dave's got a really good
point:
there's a reason your browser says who it is... if you don't need
to change it, then it's probably best to just keep it like it is. If you
go around with a user_agent field that says
"Bond (james bond; 007; UK)",you'll probably get more hassle from servers than you wanted. And for those people with foul-mouthed browsers... uh, hello?!? You live to entertain people who read server logs?
Actually, this whole thing started when I was writing some software that would respond to search robots differently than to "normal browsers"...so I made Netscape claim to be a search robot so I could test it. You see, I really had a good reason...but i didn't wanna look like a search-bot _all_ the time (especially at parties...)anyway, if you're one of those die-hard Mac people, (or a proud "Amigan" or whatever) , then realize that if you change your Browser line, then your team no longer gets a checkmark in the [MARKET SHARE] column.
some sites that think they're soooo smart:
The Wall Street Journal
ESPN's SportsZone
comments? email me! hackmsie@ryan.net