The NoScript Firefox extension provides extra protection for Firefox, Seamonkey and other mozilla-based browsers: this free, open source add-on allows JavaScript, Java and Flash and other plugins to be executed only by trusted web sites of your choice (e.g. your online bank), and provides the most powerful Anti-XSS protection available in a browser.

NoScript’s unique whitelist based pre-emptive script blocking approach prevents exploitation of security vulnerabilities (known and even not known yet!) with no loss of functionality…

When you install NoScript, JavaScript, Java, Flash Silverlight and possibly other executable contents are blocked by default. You will be able to allow JavaScript/Java/… execution (scripts from now on) selectively, on the sites you trust. You can allow a site to run scripts temporarily, if you’re just surfing randomly, or permanently, when you visit it often and you really trust it. This means that NoScript learns from your own browser habits and tends to disappear in the background after a while, but it promptly comes back to save your day if you stumble upon a malicious web page.

When you browse a site containing blocked scripts a notification, similar to those issued by popup blocker, is shown.
Look at it or at the statusbar icon to know current NoScript permissions:

  • this means that scripts and plugin contents are blocked for the current site and its subframes. Even if some of the 3rd party script sources imported by the page may be in your whitelist, no code could run because the hosting documents are not enabled.
  • this means the top level site is still forbidden but some active subcontent pieces (either frames or plugin objects) are allowed: some code may be running, but the page is likely not to work correctly yet because its main script source is still blocked.
  • this means scripts are allowed for the top-level (main) document, but some other active content or script sources imported by this page are not allowed yet. This happens when there are multiple frames, or script elements linking code hosted on 3rd party hosts.
    Since they’re often unnecessary, the site is likely to work even in this “partially allowed” state. Furthermore, in most cases when a site is compromised with JavaScript malware, the malicious code is hosted on external “shady” sites. Even if you’ve previously allowed the top-level site, these external sites are still blocked and the attack fails anyway.
  • this means that all the script sources for the page are allowed but some embedded content (frames or plugin objects) is blocked. You can check and allow the blocked content either by looking for yellow visual placeholders in the page or by examining the  Blocked Objects sub-menu.
  • – this means that scripts are allowed for some URLs, and all the other ones are marked as untrusted.
  • – this means that script execution is allowed for the current site
  • – this means that scripts are globally allowed (why did you decide to browse with low protection??!)

Download NoScript

Post By Gishore J Kallarackal (2,121 Posts)

Gishore J Kallarackal is the founder of techgurulive. The purpose of this site is to share information about free resources that techies can use for reference. You can follow me on the social web, subscribe to the RSS Feed or sign up for the email newsletter for your daily dose of tech tips & tutorials. You can content me via @twitter or e-mail.

Website: → Techgurulive

Connect