The Spanner logo
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    The Spanner logo

    The Spanner
    Web security blog

    Made by Gareth Heyes
    Follow me on Twitter: @garethheyes

    Javascript for hackers!

    Hackvertor logo
    Shazzer logo
    My Github account
    Recent posts
    Introducing Feedworm: A Privacy-First RSS Reader That Lives in DevToolsSpeedy RSVP extensionAutoVaderHackvertor history and tag finderShadow Repeater v1.2.3 releaseBurp Hackvertor v2.1.24 releaseHacking roomsXSSing TypeErrors in SafarivalueOf: Another way to get thisMaking the Unexploitable Exploitable with X-Mixed-Replace on FirefoxThe curious case of the evt parameterCSS-Only Tic Tac Toe ChallengeRewriting relative urls with the base tag in SafariBypassing DOMPurify with mXSSNew IE mutation vectorHow I smashed MentalJSMentalJS DOM bypassAnother XSS auditor bypassXSS Auditor bypassBypassing the IE XSS filterUnbreakable filterMentalJS bypassesmXSSJava SerializationBypassing the XSS filter using function reassignmentRPOSandboxed jQueryX-Domain scroll detection on IE using focusEpic fail IEnew operatorDecoding complex non-alphanumeric JavaScriptHacking FirefoxDOM ClobberingBypassing XSS AuditorThe evolution of codeNon-Alpha PHP in 6-7 charsetTweetable PHP-Non AlphaMentalJS for PHPOpera x domain with video tutorialSandboxing and parsing jQuery in 100ms

    Hidden javascript properties

    By Gareth Heyes (@hackvertor)

    Published 18 years 3 months ago • Last updated March 22, 2025 • ⏱️ < 1 min read

    ← Back to articles

    Javascript contains hidden properties in many objects, I first discovered this when DoctorDan from the slackers forum demonstrated a technique to get the text from a regular expression object without specifying the source property. Later I found a post by John Resig about weird IE behavior again with -1 properties.

    So I decided to experiment and write a little script to investigate further. I discovered that it's possible to access strings of global object names. For example:-

    <pre lang="javascript"> alert(Boolean[-6]); alert(typeof Boolean[-6]); </pre>

    It seems that Firefox at least stores names of objects in "-6", the example above returns the value "Boolean" as a string. Here's a few examples I posted slackers which use Objects to create strings.

    This is the simple script I wrote to find the properties, feel free to experiment and find any other "hidden" gems.

    <pre lang="javascript"> function inspectObject(obj) { var prop; var props = []; for(var i=-1000;i<1000;i++) { if(i > 0) { prop = obj[String.fromCharCode(i)]; if(prop != null) { props.push(String.fromCharCode(i) + '=' + prop); } } else { prop = obj[i]; if(prop != null) { props.push(i + '=' + prop); } } } return props; } x=function x(){}; inspectObject(x) </pre>

    ← Back to articles