Mengxiao Wang

Permissioner

Introduction

This tool is designed to measure the PWA (Progressive Web Application) permission systems. Further details are available in our paper.

Steps to Run the Tool

1. Prepare the Environment
   Visit https://pwa-demo.github.io/prepare. Here, you can download browsers for your mobile devices. If you are interested in downloading previous versions of a browser, a search function is also provided.

2. Permission Decision Evaluation and Browser Compatibility Analysis
   To measure Permission Decision Evaluation and Browser Compatibility Analysis, visit https://pwa-demo.github.io/default.
   To assess Cross-Browser Permission Variability Analysis, go to https://pwa-demo.github.io/plus.

3. Pre-install Actions and Post-install Tests
   Pre-install actions and post-install tests are detailed in our paper. Alternatively, you can contact the author of this repository for more information. Due to the extensive manual effort required, we do not offer a demo for these tests unless there is significant interest.

4. PWA and Browser Cleanup
   For cleaning up PWAs and browsers on your mobile devices, visit https://pwa-demo.github.io/cleanup.

Attack Demo

• Attack 1: Visit https://pwa-demo.github.io/fingerprint.
• Attack 2: Visit https://pwa-demo.github.io/crash.
• Attack 3:
  • Visit https://pwa-demo.github.io/api.
  • For the consequences, use https://pwa-demo.github.io/attack1a and https://pwa-demo.github.io/attack1b (the local server).
  • Use https://pwa-demo.github.io/nfc to demonstrate NFC capabilities.

Dataset

The dataset analysis script is located in the /analysis/data_collection folder. Due to the large size of the entire dataset, it cannot be included in the repository. If you need access to the dataset, please contact the author of this repository via email.

Please do not use these for any other purposes, as they contain sensitive information and may violate anonymity rules!

Responsible Disclosure

We will keep you updated on the status of our responsible disclosure here. Currently, the details are redacted for blind review.

Disclaimer

• Website content may change or become unavailable, resulting in varying results.
• Please refrain from using social engineering to uncover website owners’ identities.
• Do not attempt these attacks in the real world! We disclaim any responsibility for consequences arising from such actions.
• Details in our paper and this repository are intentionally limited to prevent misuse by malicious individuals.

---

For assistance with any of the above steps, please contact the author of this repository.

This site is open source. Improve this page.