The Spanner logo
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    The Spanner logo

    The Spanner
    Web security blog

    Made by Gareth Heyes
    Follow me on Twitter: @garethheyes

    Javascript for hackers!

    Hackvertor logo
    Shazzer logo
    My Github account
    Recent posts
    Introducing Feedworm: A Privacy-First RSS Reader That Lives in DevToolsSpeedy RSVP extensionAutoVaderHackvertor history and tag finderShadow Repeater v1.2.3 releaseBurp Hackvertor v2.1.24 releaseHacking roomsXSSing TypeErrors in SafarivalueOf: Another way to get thisMaking the Unexploitable Exploitable with X-Mixed-Replace on FirefoxThe curious case of the evt parameterCSS-Only Tic Tac Toe ChallengeRewriting relative urls with the base tag in SafariBypassing DOMPurify with mXSSNew IE mutation vectorHow I smashed MentalJSMentalJS DOM bypassAnother XSS auditor bypassXSS Auditor bypassBypassing the IE XSS filterUnbreakable filterMentalJS bypassesmXSSJava SerializationBypassing the XSS filter using function reassignmentRPOSandboxed jQueryX-Domain scroll detection on IE using focusEpic fail IEnew operatorDecoding complex non-alphanumeric JavaScriptHacking FirefoxDOM ClobberingBypassing XSS AuditorThe evolution of codeNon-Alpha PHP in 6-7 charsetTweetable PHP-Non AlphaMentalJS for PHPOpera x domain with video tutorialSandboxing and parsing jQuery in 100ms

    Setters using VBS and constant hacks

    By Gareth Heyes (@hackvertor)

    Published 15 years 10 months ago • Last updated April 28, 2025 • ⏱️ 2 min read

    ← Back to articles

    I wasn't gonna blog this because I couldn't be bothered but Mario asked me if I had it documented anywhere and I guess it's nice to have it somewhere. So I was looking to create setters in legacy browsers like IE7 and it would be nice to use them on custom objects in IE8. I came up with the following VBS hack:-

    execScript("Class c\nProperty Let x(y)\nalert(y)\nEnd Property\nEnd Class\nSet obj=new c","VBScript");obj.x=1;//yeah js calls vbs ;)

    Pretty cool calling VBS from JS then using a VBS object inside JS :)

    Ok and now some constant stuff I tweeted before but I quite like so I'll post here too. Constants are weird in JavaScript, when you think about them you think in a value that cannot change but when it comes to objects they can't be constants for some reason. I dunno why they could be implemented quite easily by creating a Getter only object but anyway:-

    //example1 const x={};x.y=123;alert(x.y)//Objects aren't constants! //example2 (need to run separately of course const x={};x.toString=x.valueOf=function() { return 1; };alert(x)

    Finally I'll leave you with a quiz, what is "x" equal to without running?:-

    var x=1; function y() { x=3; alert(x); return; const x=2;}y()// x == ?

    ← Back to articles