supercookie Cookie追踪检测工具：浏览器隐私保护的隐形卫士

# Chrome扩展安装（通过开发者模式）
git clone https://github.com/suyashkumar/supercookie.git
cd supercookie/extension
# 打开Chrome浏览器 -> 更多工具 -> 扩展程序 -> 开启开发者模式 -> 加载已解压的扩展程序 -> 选择extension目录

# 使用npm安装
npm install -g supercookie-detector

# 使用pip安装Python版本
pip install supercookie-detector

docker pull suyashkumar/supercookie-detector
docker run -p 3000:3000 suyashkumar/supercookie-detector

// 创建配置文件 supercookie-config.json
{
  "detectionTypes": ["hsts", "etag", "localStorage", "canvasFingerprint"],
  "reportFormat": "json",
  "outputPath": "./reports",
  "thresholds": {
    "fingerprintSimilarity": 0.9,
    "trackingConfidence": 0.8
  }
}

// 引入supercookie检测库
import { SuperCookieDetector } from 'supercookie-detector';

// 创建检测器实例
const detector = new SuperCookieDetector();

// 执行检测
async function runDetection() {
  try {
    const results = await detector.detectAll();
    
    console.log('检测结果:', results);
    
    // 处理检测结果
    if (results.hsts.detected) {
      console.warn('发现HSTS supercookie:', results.hsts.details);
    }
    
    if (results.etag.detected) {
      console.warn('发现ETag supercookie:', results.etag.details);
    }
    
    if (results.localStorage.detected) {
      console.warn('发现LocalStorage supercookie:', results.localStorage.details);
    }
    
    if (results.canvasFingerprint.detected) {
      console.warn('发现Canvas指纹:', results.canvasFingerprint.details);
    }
    
  } catch (error) {
    console.error('检测过程中出错:', error);
  }
}

// 运行检测
runDetection();

from supercookie_detector import SuperCookieDetector
import json

# 创建检测器实例
detector = SuperCookieDetector()

# 执行全面检测
results = detector.detect_all()

# 打印检测结果
print("=== supercookie检测结果 ===")
for detection_type, data in results.items():
    print(f"\n{detection_type}:")
    print(f"  检测到: {'是' if data['detected'] else '否'}")
    if data['detected']:
        print(f"  置信度: {data['confidence']:.2f}")
        print(f"  详情: {json.dumps(data['details'], indent=2)}")

# 生成可视化报告
detector.generate_report("supercookie_report.html")
print("\n报告已生成: supercookie_report.html")

# 基本检测
supercookie-detector --url https://example.com

# 检测多个网站
supercookie-detector --urls https://example.com,https://test.com

# 使用配置文件
supercookie-detector --config supercookie-config.json --url https://example.com

# 生成详细报告
supercookie-detector --url https://example.com --report detailed

# 检测特定类型的supercookie
supercookie-detector --url https://example.com --types hsts,etag,canvasFingerprint

// ETag supercookie实现示例
app.get('/track', (req, res) => {
  // 检查If-None-Match头
  if (req.headers['if-none-match']) {
    // 提取追踪ID
    const trackingId = req.headers['if-none-match'].replace(/"/g, '');
    console.log('追踪到用户:', trackingId);
    res.status(304).end(); // 未修改
  } else {
    // 生成新的追踪ID
    const trackingId = generateUniqueId();
    // 设置ETag头
    res.setHeader('ETag', `"${trackingId}"`);
    res.setHeader('Cache-Control', 'public, max-age=31536000');
    res.send('Tracking enabled');
  }
});

// Canvas指纹生成示例
function generateCanvasFingerprint() {
  const canvas = document.createElement('canvas');
  const ctx = canvas.getContext('2d');
  
  // 绘制特定图形
  ctx.fillStyle = 'rgb(255, 0, 0)';
  ctx.fillRect(0, 0, 100, 100);
  ctx.fillStyle = 'rgb(0, 255, 0)';
  ctx.fillRect(10, 10, 80, 80);
  ctx.fillStyle = 'rgb(0, 0, 255)';
  ctx.fillRect(20, 20, 60, 60);
  
  // 添加文本
  ctx.font = '12px Arial';
  ctx.fillStyle = 'rgb(255, 255, 255)';
  ctx.fillText('supercookie', 30, 55);
  
  // 获取数据URL并生成哈希
  const dataURL = canvas.toDataURL();
  const fingerprint = generateHash(dataURL);
  
  return fingerprint;
}

#!/bin/bash

# 测试脚本：supercookie检测性能测试

# 测试网站列表
WEBSITES=("https://google.com" "https://facebook.com" "https://twitter.com" "https://amazon.com" "https://github.com")

# 测试次数
TEST_COUNT=10

# 结果文件
RESULT_FILE="performance_test_results.csv"

# 初始化结果文件
echo "网站,平均检测时间(ms),CPU使用率(%),内存占用(MB),检测到的supercookie数量" > $RESULT_FILE

for website in "${WEBSITES[@]}"; do
    echo "测试网站: $website"
    
    # 初始化统计变量
    total_time=0
    total_cookies=0
    
    for ((i=1; i<=TEST_COUNT; i++)); do
        echo "  测试 $i/$TEST_COUNT..."
        
        # 运行检测并获取结果
        result=$(supercookie-detector --url "$website" --format json)
        
        # 提取检测时间和supercookie数量
        detection_time=$(echo $result | jq '.performance.detectionTime')
        cookie_count=$(echo $result | jq '.results | length')
        
        # 累加统计
        total_time=$(echo "$total_time + $detection_time" | bc)
        total_cookies=$(echo "$total_cookies + $cookie_count" | bc)
    done
    
    # 计算平均值
    avg_time=$(echo "scale=2; $total_time / $TEST_COUNT" | bc)
    avg_cookies=$(echo "scale=2; $total_cookies / $TEST_COUNT" | bc)
    
    # 获取系统资源使用情况
    cpu_usage=$(top -bn1 | grep "Cpu(s)" | awk '{print $2 + $4}')
    memory_usage=$(free -m | grep Mem | awk '{print $3}')
    
    # 保存结果
    echo "$website,$avg_time,$cpu_usage,$memory_usage,$avg_cookies" >> $RESULT_FILE
    
    echo "  平均检测时间: $avg_time ms"
    echo "  平均检测到的supercookie数量: $avg_cookies"
    echo ""
done

echo "性能测试完成，结果已保存到 $RESULT_FILE"

#!/usr/bin/env python3

# 检测准确率测试脚本

import json
import subprocess
import time

def test_detection_accuracy():
    # 测试用例：已知包含supercookie的网站
    test_cases = [
        {
            "url": "https://example-with-hsts.com",
            "expected_cookies": ["hsts"],
            "description": "包含HSTS supercookie的网站"
        },
        {
            "url": "https://example-with-etag.com", 
            "expected_cookies": ["etag"],
            "description": "包含ETag supercookie的网站"
        },
        {
            "url": "https://example-with-canvas.com",
            "expected_cookies": ["canvasFingerprint"],
            "description": "包含Canvas指纹的网站"
        },
        {
            "url": "https://example-clean.com",
            "expected_cookies": [],
            "description": "不包含supercookie的网站"
        }
    ]
    
    results = []
    
    for case in test_cases:
        print(f"测试: {case['description']}")
        print(f"  URL: {case['url']}")
        print(f"  预期检测: {case['expected_cookies']}")
        
        # 运行检测
        start_time = time.time()
        result = subprocess.run(
            ["supercookie-detector", "--url", case['url'], "--format", "json"],
            capture_output=True,
            text=True
        )
        end_time = time.time()
        
        detection_time = end_time - start_time
        
        if result.returncode == 0:
            detected_cookies = json.loads(result.stdout)
            found_cookies = [cookie for cookie, data in detected_cookies['results'].items() if data['detected']]
            
            # 计算准确率指标
            true_positives = len(set(found_cookies) & set(case['expected_cookies']))
            false_positives = len(set(found_cookies) - set(case['expected_cookies']))
            false_negatives = len(set(case['expected_cookies']) - set(found_cookies))
            
            accuracy = true_positives / (true_positives + false_positives + false_negatives) if (true_positives + false_positives + false_negatives) > 0 else 1.0
            precision = true_positives / (true_positives + false_positives) if (true_positives + false_positives) > 0 else 1.0
            recall = true_positives / (true_positives + false_negatives) if (true_positives + false_negatives) > 0 else 1.0
            
            print(f"  实际检测: {found_cookies}")
            print(f"  检测时间: {detection_time:.2f}秒")
            print(f"  准确率: {accuracy:.2f}")
            print(f"  精确率: {precision:.2f}")
            print(f"  召回率: {recall:.2f}")
            
            results.append({
                "url": case['url'],
                "description": case['description'],
                "expected": case['expected_cookies'],
                "found": found_cookies,
                "detection_time": detection_time,
                "accuracy": accuracy,
                "precision": precision,
                "recall": recall
            })
        else:
            print(f"  检测失败: {result.stderr}")
            results.append({
                "url": case['url'],
                "description": case['description'],
                "error": result.stderr
            })
        
        print()
    
    # 保存结果
    with open('accuracy_test_results.json', 'w') as f:
        json.dump(results, f, indent=2)
    
    print("准确率测试完成，结果已保存到 accuracy_test_results.json")

if __name__ == "__main__":
    test_detection_accuracy()

// 示例：优化Chrome浏览器隐私设置
chrome.privacy.websites.supercookieBlocking.set({value: 'always'});
chrome.privacy.websites.doNotTrackEnabled.set({value: true});
chrome.privacy.services.hyperlinkAuditingEnabled.set({value: false});

// 示例：设置Cookie安全属性
res.cookie('sessionId', sessionId, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
  maxAge: 3600000 // 1小时
});

// 示例：在Express.js中支持Do Not Track
app.use((req, res, next) => {
  if (req.headers['dnt'] === '1') {
    // 不使用追踪技术
    req.session.disableTracking = true;
  }
  next();
});