// ============================================================================ // Firefox Hardened user.js -- Pentesting + Privacy Profile // Based on arkenfox/user.js with pentesting additions // Place in: ~/.mozilla/firefox//user.js // ============================================================================ // === STARTUP === user_pref("browser.aboutConfig.showWarning", false); // no warning on about:config user_pref("browser.startup.homepage", "about:blank"); // blank homepage user_pref("browser.newtabpage.enabled", false); // blank new tab user_pref("browser.startup.homepage_override.mstone", "ignore"); // no whats-new page // === TELEMETRY / DATA COLLECTION -- kill it all === user_pref("datareporting.policy.dataSubmissionEnabled", false); // no data submission user_pref("datareporting.healthreport.uploadEnabled", false); // no health reports user_pref("toolkit.telemetry.enabled", false); // no telemetry user_pref("toolkit.telemetry.unified", false); // no unified telemetry user_pref("toolkit.telemetry.server", "data:,"); // empty telemetry server user_pref("toolkit.telemetry.archive.enabled", false); // no telemetry archive user_pref("toolkit.telemetry.newProfilePing.enabled", false); // no new profile ping user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // no shutdown ping user_pref("toolkit.telemetry.updatePing.enabled", false); // no update ping user_pref("toolkit.telemetry.bhrPing.enabled", false); // no background hang ping user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // no first shutdown ping user_pref("toolkit.telemetry.coverage.opt-out", true); // coverage opt-out user_pref("toolkit.coverage.opt-out", true); // coverage opt-out user_pref("toolkit.coverage.endpoint.base", ""); // no coverage endpoint user_pref("browser.ping-centre.telemetry", false); // no ping-centre user_pref("beacon.enabled", false); // no beacon API user_pref("app.shield.optoutstudies.enabled", false); // no shield studies user_pref("app.normandy.enabled", false); // no normandy/recipes user_pref("app.normandy.api_url", ""); // no normandy API user_pref("breakpad.reportURL", ""); // no crash reports user_pref("browser.tabs.crashReporting.sendReport", false); // no tab crash reports user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // no auto crash submit user_pref("browser.discovery.enabled", false); // no extension recommendations user_pref("extensions.getAddons.showPane", false); // no addon recommendations user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); // no addon recommendations // === GEOLOCATION === user_pref("geo.enabled", false); // disable geolocation user_pref("geo.wifi.uri", ""); // no wifi geolocation user_pref("browser.region.network.url", ""); // no region detection user_pref("browser.region.update.enabled", false); // no region updates // === NETWORK / DNS === user_pref("network.prefetch-next", false); // no link prefetching user_pref("network.dns.disablePrefetch", true); // no DNS prefetching user_pref("network.predictor.enabled", false); // no network predictor user_pref("network.http.speculative-parallel-limit", 0); // no speculative connections user_pref("browser.places.speculativeConnect.enabled", false); // no speculative connects user_pref("network.dns.disableIPv6", true); // disable IPv6 DNS (leak prevention) user_pref("network.proxy.socks_remote_dns", true); // DNS through SOCKS proxy user_pref("network.trr.mode", 2); // DNS over HTTPS (2=preferred, 3=forced) user_pref("network.trr.uri", "https://dns.quad9.net/dns-query"); // Quad9 DoH (malware blocking) // === WEBRTC -- critical for IP leak prevention === user_pref("media.peerconnection.enabled", false); // disable WebRTC entirely user_pref("media.peerconnection.ice.default_address_only", true); // fallback: only default route user_pref("media.peerconnection.ice.no_host", true); // no host candidates user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); // force proxy // === TLS / SSL === user_pref("security.tls.version.min", 3); // TLS 1.2 minimum user_pref("security.tls.enable_0rtt_data", false); // no 0-RTT (replay risk) user_pref("security.ssl.require_safe_negotiation", true); // require safe renegotiation user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); // warn on unsafe user_pref("browser.xul.error_pages.expert_bad_cert", true); // show cert details on error user_pref("security.cert_pinning.enforcement_level", 2); // strict cert pinning user_pref("security.pki.sha1_enforcement_level", 1); // forbid SHA-1 certs user_pref("security.OCSP.enabled", 1); // enable OCSP checking user_pref("security.OCSP.require", true); // hard-fail on OCSP error // === COOKIES === user_pref("network.cookie.cookieBehavior", 1); // block third-party cookies user_pref("network.cookie.lifetimePolicy", 2); // session-only cookies user_pref("network.cookie.thirdparty.sessionOnly", true); // third-party session only user_pref("privacy.firstparty.isolate", true); // first-party isolation // === FINGERPRINTING RESISTANCE === user_pref("privacy.resistFingerprinting", true); // resist fingerprinting (changes canvas, timezone, etc.) user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // block addon manager fingerprinting user_pref("webgl.disabled", true); // disable WebGL (fingerprint vector) user_pref("media.navigator.enabled", false); // hide camera/mic enumeration user_pref("dom.battery.enabled", false); // no battery API user_pref("dom.event.clipboardevents.enabled", false); // no clipboard events user_pref("dom.gamepad.enabled", false); // no gamepad API user_pref("dom.vr.enabled", false); // no VR API user_pref("dom.vibrator.enabled", false); // no vibration API user_pref("dom.enable_performance", false); // no performance API user_pref("dom.enable_resource_timing", false); // no resource timing API user_pref("dom.maxHardwareConcurrency", 4); // spoof CPU count user_pref("font.system.whitelist", ""); // restrict system fonts // === REFERRER POLICY === user_pref("network.http.referer.XOriginPolicy", 2); // no cross-origin referrers user_pref("network.http.referer.XOriginTrimmingPolicy", 2); // trim to scheme+host+port user_pref("network.http.sendRefererHeader", 0); // never send referrer // === SAFE BROWSING (Google) -- disable phoning home === user_pref("browser.safebrowsing.malware.enabled", false); // no Google safe browsing user_pref("browser.safebrowsing.phishing.enabled", false); // no phishing check user_pref("browser.safebrowsing.downloads.enabled", false); // no download check user_pref("browser.safebrowsing.downloads.remote.enabled", false); // no remote download check user_pref("browser.safebrowsing.downloads.remote.url", ""); // no remote URL // === DOWNLOADS === user_pref("browser.download.useDownloadDir", false); // always ask where to save user_pref("browser.download.manager.addToRecentDocs", false); // no recent docs // === FORMS / AUTOFILL === user_pref("browser.formfill.enable", false); // no form history user_pref("extensions.formautofill.addresses.enabled", false); // no address autofill user_pref("extensions.formautofill.creditCards.enabled", false); // no credit card autofill user_pref("signon.rememberSignons", false); // no password saving user_pref("signon.autofillForms", false); // no password autofill user_pref("signon.formlessCapture.enabled", false); // no formless capture // === DRM / PLUGINS === user_pref("media.eme.enabled", false); // no DRM user_pref("media.gmp-widevinecdm.enabled", false); // no Widevine user_pref("media.gmp-manager.url", "data:text/plain,"); // no plugin manager // === PDF.js === user_pref("pdfjs.disabled", true); // disable built-in PDF (attack surface) // === MISC HARDENING === user_pref("dom.disable_window_move_resize", true); // no window manipulation user_pref("dom.disable_open_during_load", true); // block popups during load user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); // strict popup events user_pref("accessibility.force_disabled", 1); // disable accessibility services user_pref("browser.helperApps.deleteTempFileOnExit", true); // clean temp files user_pref("browser.pagethumbnails.capturing_disabled", true); // no page thumbnails user_pref("browser.uitour.enabled", false); // no UI tours user_pref("permissions.manager.defaultsUrl", ""); // no default permissions user_pref("webchannel.allowObject.urlWhitelist", ""); // no webchannel user_pref("permissions.delegation.enabled", false); // no permission delegation user_pref("browser.contentblocking.category", "strict"); // strict content blocking // === DISK AVOIDANCE (reduce forensic footprint) === user_pref("browser.cache.disk.enable", false); // no disk cache user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // media to memory user_pref("browser.sessionstore.privacy_level", 2); // no session store for any site user_pref("browser.shell.shortcutFavicons", false); // no favicon cache user_pref("browser.cache.memory.capacity", 65536); // 64MB memory cache max // === PENTESTING SPECIFIC === user_pref("devtools.chrome.enabled", true); // enable browser console user_pref("devtools.debugger.remote-enabled", true); // enable remote debugging user_pref("devtools.inspector.showAllAnonymousContent", true); // show shadow DOM user_pref("network.http.max-persistent-connections-per-proxy", 48); // more proxy connections user_pref("network.http.max-persistent-connections-per-server", 12); // more server connections user_pref("security.mixed_content.block_active_content", false); // allow mixed content (testing) user_pref("security.mixed_content.block_display_content", false); // allow mixed display user_pref("network.stricttransportsecurity.preloadlist", false); // disable HSTS preload (testing) user_pref("security.csp.enable", false); // disable CSP (testing only)