HTML Ping Attribute Explained ˂ href = ‘

[@armaandhanji7151]

Hussein, your channel should have 340k subscribers, honestly the highlight of my day whenever I see a new video added by you. As always, thank you for the great context!

[@a.yashwanth]

from chrome docs Because a cookie's SameSite attribute was not set or is invalid, it defaults to SameSite=Lax, which prevents the cookie from being sent in a cross-site request.

[@hnasr]

Thanks! That looks about right, so we are safe unless user explicitly set SameSite None

[@NC_RC]

That thumbnail... 😄 Perfect. Great job on the video, Hussein. I really don't understand why your channel doesn't have ten times the audience. Keep up the fantastic work; we'll keep learning and sharing!

[@hnasr]

Thanks Neil! I am just grateful to have you guys watching, 34K is still a lot and appreciate every single view and comment (L)

[@NC_RC]

@@hnasr oh you're absolutely right, 34k is a massive number! :) I'm just watching your Certificates series and in just two videos you have already cleared up some concepts that I'd been struggling with. I really appreciate your videos and enjoy your delivery. Thank you!

[@AdarshMenon]

Really awesome stuff Hussein! Like you said I think this is useful for some cases, but really concerning. Also those use-cases can be implemented without the ping attribute, so in my opinion all browsers should disable this.

[@billybunn]

Wow, never heard of this before, thank you!

[@ManojKumar-ti8rn]

I really can't explain how grateful to you. Really thank you for your work.

[@hnasr]

You're very welcome Manjo!! appreciate it !

[@Clepsyd_]

I have something to add to the Firefox bit. At 10:30 you say "They don't lie, they actually show you that it's a google URL". They actually do "lie" in a very sneaky way :D - The original href when the page loads IS the actual URL you're supposed to be redirected to (linkedin.com/hsnaser in that case). If you just hover on a link without clicking it, that's what you'll see at the bottom of the screen, or if you inspect the HTML without doing a right click directly on the link. I suspect it's this `onmousedown` attribute you glossed over quickly, which triggers some JS function which replaces the href to the google's url when you press down the mouse button, and when you release it that's when you actually navigate, to the freshly replaced google.com/?... href value. Really sneaky. Great video otherwise thanks! I didn't know about this ping attribute :D

[@patrick-dev]

Thank you so much for this informational video. Even though its scary, I feel a lil bit secure in terms of cookies, I always set them up to Lax or Strict.

[@lord12790]

Wow didn't knew that it exists, that's why always waiting for your videos, thank you

[@BastiDood]

Thank you for sharing this. I am very disturbed that I only knew about this now. _Perhaps the sneakiness is intentional..._ 🤔 👀

[@KostasOreopoulos]

It is a POST request, but as you mentioned with no body, so I do not see any actual difference in functionality from a GET request except semantics. Since tracking IS storing information it should be a post request to signal that. The only problem with that is the DDOS attacks that could be orchestrated (but I guess its not that hard to firewall ping requests originating from places you do not want. I wonder how this "circumvents" the no-cookies GDPR clause.

[@hnasr]

Kostas Oreopoulos correct its a POST with a body of PING so very similar to GET, we confirmed with google Dev team that SameSite lax cookies won’t be sent. How would you block ping POST request on the firewall if those are encrypted(Https) to prevent DDOS ?

[@KostasOreopoulos]

@@hnasr You are correct. I forgot about the https. They is not an automated way to stop that DDOS attack

[@parlor3115]

About this feature being a security risk, I don't see how because it can't share the main page's cookies so it's not vunerable to CSRF nor can it execute scripts so it's not XSS vunerable.

[@deshkarabhishek]

I will never stop watching if you upload these type of videos

[@Nurckye]

Nice content, keep it rolling

[@hnasr]

Always

[@mohammedissam3651]

Thanks, Hussein. Useful lesson.

[@VinuP2023]

Thank you so much for all your videos. Please don't stop making these tutorials. Can you please make some .net related videos?

[@hnasr]

Been a while since I made a .NET video here is playlist on VB.NET kzbin.info/aero/PLQnljOFTspQX-XZChZg-b06MJ27nAJQS9 I also have a C# crash course C# by Example Crash Course kzbin.info/www/bejne/rZnYlJaiZ6uBn6s

[@VinuP2023]

Hussein thanks for the quick response. I will surely watch these videos. I hope you make .net related stuff in future :)

[@shreshtharora]

Thanks man for this amazing video. 👏👏

[@panossavvaidis6086]

so, I guess that in case you own a server and you want to stop malicious activity, couldn't you discard requests that come with 'text/ping' content type?

[@artso003]

Great video. Keep it going!

[@adrianfgutierrez2836]

Good job Hussein 👍🏾

[@hnasr]

Thank you Adrian!!

[@6365bharath]

I had no idea this existed. Thanks as always Hussein. Do you have any videos on Elastic Search?

[@hnasr]

Bharath Kumar thank you Bharath ! I don’t but planning on making one on ES. It is a popular requested video

[@shashikantsharma3551]

Thanks you for the info.... wasn't aware of it.

[@sariksiddiqui6059]

I was thinking if a website doesnt uses SSL(say abc) , you can just post a link

[@hnasr]

lets say you are logged in to facebook.com, which means you have a cookie on your browser. Lets say SameSite=None for that cookie. Now I give you a link to my evil.com website which has the following click here to visit facebook The act of clicking the link will send a POST request to facebook.com/post.php (because of ping) and because you are already logged in, and you have a cookie SameSite=None, than the browser will also send the cookies to facebook.com/post.php and that event creates a post on your behalf. you can as similarly delete a post, a video, picture or do so many other things on behalf of the user by just clicking a link! Obviously this example will not work because facebook uses samesite=lax cookies which will not send the cookies (need to confirm what happens with ping)

[@sariksiddiqui6059]

Makes sense. Am not sure if you could actually attach payload to these pings . Chrome doesnt even show request type for these pings(but we could see we hit post). Also wandering what’s stopping from a rival company to use the google ping url and bombard it with fake random data

[@ahmedkhudhair8035]

Very interesting , can I use this for sending email , instead of making new thread to send email , because it runs asynchronously ?

[@hnasr]

Sure!! You can send an email when a user clicks on a link. The ping will do a POST and you can send the email from the backend

[@hnasr]

Great usecase

[@sairam-lj6zu]

Great video nasseir. I don't think it will be a security threat as if you mention other domain url the cookies won't be passed because of Same origin policy. It could be dangerous when a hacker can inject links in the content using html Injection vulnerabilities where in that case hacker can point the ping url to same site to some sensitive endpoint like delete account, change status etc., etc.,

[@FordExplorer-rm6ew]

Never knew this exist. Thank u

[@DamjanDimitrioski]

Odd, I enable send_pings in Firefox Nightly, and also disabled the enhanced protection, still, Google doesn't add the ping attribute, I think It's playing safe :D.

[@hnasr]

Oh Firefox has ping now! Interesting

[@davilinkicefire]

Google probably check the UserAgent header of the request to figure out if it need to add the ping attribute or the fallback tracking method

[@bhavesh_thakur]

Fantastic !! I am thinking how I can use this exploiting CSRF vulnerability.

[@deshkarabhishek]

You can't do it

[@SR-sz9zh]

Thanks, you make good content :)

[@hnasr]

I appreciate that! THANK!!! Much love

[@大盗江南]

Thx bubby 😁😁😁

[@supersu6138]

Oh boy so thats y Firefox is a bit slower

[@evolagenda]

Would've been cool if you also tried duckduckgo

[@hnasr]

Oh man! I forgot! I bet they don’t.. (just checked they dont$

[@evolagenda]

@@hnasr I flred up a session myself, would just have been a nice addition to show people. The results aren't as good but it's worth it.

[@takshpatel8109]

that was awesome

[@LordNementon]

Don't worry, banks use CSRF token, or at least you shall change of banks if they doesn't support basic security 😜

[@alexmattyou]

Ping don't work in Microsoft edge. I think that's safe

[@sabuein]

Thank you.

[@mohammedabahussain4562]

Intersting