Hack sbicapsec.com to run on Firefox


www.sbicapsec.com is State Bank of India’s online share trading portal. This is a good portal but their site’s code quality is amazingly of low quality, dare I say, crappy. SBI being a public sector government institute, we can rest assured that the code quality or bugs in it would not get fixed soon, if ever.

Anyway as of now if you try using this portal in Firefox or Chrome, then maybe you will endup with a screen like this.

sbicapsec.com after login in Firefox. Notice no applet running, instead we have weird “:10”.

Notice the weird “:10” character in the screenshot, instead of the Java Applet.

Fixing sbicapsec.com to run in Firefox

Don’t worry the “hack” here is not illegal. This is used merely as an expression for making things work the way you want it which requires a lot of technical trickery to get it right.

The following has been tested in Firefox 13 and 14 in Mac OSX and Windows XP. You are free to try this as you may want it though. Also this should work in Chrome too.

Now let’s get into fixing this in few simple steps:-

  1. For your sake, open this blog page in your Firefox browser.
  2. Install GreaseMonkey browser extension. You may need to restart your browser.
  3. Install my GreaseMonkey user script by clicking on the link here – AppVersion Patch for SBICAPSEC.
  4. Click on Install button in the dialog box that you get.

That is it! You should now get the applet after login.

Fixed sbicapsec.com, after login.

How the fix works (for the technically inclined)

This section is for geeks, who would like to know how the script works. Also it is better to understand this, so that you understand, there is no malicious code in my script.

What is wrong in sbicapsec.com’s site? (Root cause)

The portal’s JS code assumes that `navigator.appVersion` will always return a string which will have a semi-colon (;). In fact that is true for IE and Chrome (in Mac OSX version only), but not for others. After this failure everything goes down like dominoes.

The popup we get after login has a `frameset` with three frames. The second one is the one which is supposed to present the Java applet. The layout of that page is roughly as below:-

[code lang=”html”]



It seems the devs there had a requirement to set the `width` and `height` of the `applet` based on user screen’s dimension. For this they modified the code to use JS to dynamically generate the upper `applet` tag.

[code lang=”html”]

// This script will generate the upper applet tag with appropriate width and height.


It is in the above `script` tag where it reads `navigator.appVersion` and tries to split it by `;` and then read the other part. When that errors out, so does the code following it. That code is supposed to write the upper `applet` tag. So, at the end we are left with many `param` tags and a dangling `</applet>` tag. The weird `:10` characters are written between two `param` tags.

From the way they have written the JS code, it seems the devs did not visualize the html page as a tree of blocks, instead for them it was a file stream; like the kind when you use your Java or C++ file output stream. The `script` block above uses `document.write()` to write the opening `applet` tag, instead of using JS to directly manipulate the DOM objects. I wonder how these devs can layout a page, who visualize it as a stream of characters? And, this is just a fraction of the real code, who knows what else is inside. It seems SBI needs to seriously train its devs. All this makes me loose faith over the security and reliability of their site.

Anyway, enough of the rant, back to the topic. The patch script I wrote will, simply try to do what there code was meant to do, add the `applet` tag. Because of the dangling `applet` end tag, I was unable to wrap my `applet` around the existing `param` tags. So, instead I detached all the `param` tags, emptied the parent (this reference was stored before detaching `param`), then added `param` tags inside the newly create `applet` tag and finally added the `applet` inside the previous parent of `param` tags.

I also tried using other techniques but they did not work. The first one was directly modifying `navigator.appVersion` to return a string with `;`, but it seems you cannot modify them. The second options was to replace existing `String.split()` function with my own version. In my version I would always return an array of at least length two, so that the code does not error out. Anyway this too did not work out since GreaseMonkey scripts are ran after the page is executed. GreaseMonkey does provide an option to run our scripts at the beginning too, but according to docs that is not supported inside frames.

Anyway, all’s well that ends well. 🙂

Fix non-stop repeated proxy authentication dialog box in FireFox.

If repeated proxy authentication in Firefox bugging you so much, here is the trick to fix it. I tried and it is working fine.

  1. In FF Location bar, type about:config, and press Enter.
    “This might void your warranty!” warning page may appear. Click I’ll be careful, I promise!, to continue to the about:config page.
  2. In the about:config page, search for the preference “network.negotiate-auth.allow-proxies”.
  3. Double-click on it and will see the value will change to false.
  4. Restart FF and get rid of Proxy Authentication pop up.

Router settings for TATA Indicom Broadband connection.

I have a Netgear ADSL Wifi router. The router provided to me by TATA Indicom was below par so I decided to use my router. Below are the settings you need to configure your router. Note that you need a router with ADSL modem (like my Netgear DG834G).

Multiplexing method: LLC-Based
DSL Mode: ADSL2+
VPI: 0
VCI: 32
Encapsulation: PPPoE (Point to Point Protocol over Ethernet)
Login: (e.g. chitran@vsnl.com, check the receipt given to you for your email ID)
Password: (default is reset123)
That’s it. These the critical values you need. Particularly if you set VPI and VCI values to anything but the ones listed above then you will not be able to connect to the net.
Happy surfing!
PS: If your plan provides static IP address then chances are that you will be using completely different protocol, e.g. maybe MER (MAC Encapsulated Routing) instead of PPPoE. In that case the above giude is not useful for you.

Access banned sites in colleges.

Colleges have the irritating habit of playing god to their students by blocking harmless sites like Orkut, etc. In our college they have blocked the pictures from Orkut! This is simply outrageous. My friend’s college have gone far enough to block Orkut altogether. I think the college administration need to mature up and accept the fact that we ourselves are mature enough.

So, proxy servers are our salvation. Goto wikipedia to know what a proxy server is. Anoymouse.org is a popular one and maybe it is already blocked. Switchproxy.com is one site which lists about 10,000 proxy servers and even notifies whether the site is up and fast or up but slow or status not known by green, yellow and no colour respectively. Just type in the url (include http:// also) and click on the proxy server you want to use. Note that some of these listed servers may ask for money to access some sites. Click on Back and try out any other servers.

In case your college has even blocked switchproxy.com then here are some of the proxies from the list there. I have tested them that they open Orkut successfully.

If you are geeky enough then try TOR with Privoxy. It is a software to setup proxy server on your computer. It is very difficult (if not impossible) to track you on the Internet. To know how to set it up using Firefox and from where to download all the required softwares goto http://www.jgmnet.org/torfaq.html.

For geeks:-
I don’t know specifically if Tor will allow you to access banned sites or not. For this purpose you need tunneling softwares.
1) See a list of free tunneling softwares at http://www.freedownloadmanager.org/downloads/proxy_tunneling_info/ .
2) http://theproxyconnection.com/firewallsupport.html
3) http://www.freeproxy.ru/en/programs/httport.htm