3 ms·

A metasearch engine, written in Javascript, that executed entirely on the browser. How? The page was hosted at d.o.w.s.e.r.bueno.org. o.w.s.e.r.bueno.org pointe

by aristus 19y ago

A metasearch engine, written in Javascript, that executed entirely on the browser. How? The page was hosted at d.o.w.s.e.r.bueno.org. o.w.s.e.r.bueno.org pointed to Google, w.s.e.r.bueno.org pointed to Yahoo, etc. The XmlHttpRequests always appear to go to a root domain of the page, so it worked. That one still makes me grin.

DanielBMarkham 19y ago
I like that a lot! Use the DNS system to outwit the stupid XMLHttpRequest sandbox. Way cool.
- aristus 19y ago
  Thanks, but while the restrictions on XHR are heavy, they aren't stupid. An unnamed party used the same idea to implement a LAN sniffer: each successive root domain pointed to the IP addresses of well-known routers, like 192.168.15.1. The script ran down the chain and attempted to log in to the admin page of the router, using default passwords.
  - DanielBMarkham 19y ago
    Nice. Not that I approve. But nice. I'm a JSON person myself. Ran into too many problems with domains and XMLHttpRequest. From a security standpoint, the entire browser is broken, but that's probably a discussion for another day. Neat how you re-routed.
  - aston 19y ago
    The real point is that with enough smarts, you can get around the restrictions, so you might as well eliminate them altogether so that there's no false sense of security.
    - aristus 19y ago
      I feel that way sometimes when I can't do something cool. But it passes. No restrictions on user processes is a major reason why "Windows security" is a contradiction, for example. It doesn't work in an adversarial networked environment.
aston 19y ago
The easiest way I've found so far is to dynamically create a script object on the page and set its .src to some dynamic page (which can, by the nature of script src be on any server). You have to have your remote script serve back Javascript, but that's about it. Google uses something like it to do their content ad RPC's when you opt for the Javascript method rather than the IFrame.

by aristus 19y ago

DanielBMarkham 19y ago

I like that a lot! Use the DNS system to outwit the stupid XMLHttpRequest sandbox. Way cool.

aristus 19y ago
Thanks, but while the restrictions on XHR are heavy, they aren't stupid. An unnamed party used the same idea to implement a LAN sniffer: each successive root domain pointed to the IP addresses of well-known routers, like 192.168.15.1. The script ran down the chain and attempted to log in to the admin page of the router, using default passwords.
- DanielBMarkham 19y ago
  Nice. Not that I approve. But nice. I'm a JSON person myself. Ran into too many problems with domains and XMLHttpRequest. From a security standpoint, the entire browser is broken, but that's probably a discussion for another day. Neat how you re-routed.
- aston 19y ago
  The real point is that with enough smarts, you can get around the restrictions, so you might as well eliminate them altogether so that there's no false sense of security.
  - aristus 19y ago
    I feel that way sometimes when I can't do something cool. But it passes. No restrictions on user processes is a major reason why "Windows security" is a contradiction, for example. It doesn't work in an adversarial networked environment.

aston 19y ago

The easiest way I've found so far is to dynamically create a script object on the page and set its .src to some dynamic page (which can, by the nature of script src be on any server). You have to have your remote script serve back Javascript, but that's about it. Google uses something like it to do their content ad RPC's when you opt for the Javascript method rather than the IFrame.