Try and view the source

#1

Post by ohashi » Mon, Mar 19, 2012, 3:35 AM UTC

Try and view the source
kurlak.com

Re: Try and view the source

#2

Post by Flam » Mon, Mar 19, 2012, 4:29 AM UTC

This is why I love NoScript. Viewed it no problems and easily saw what you were doing. Pretty clever trick, thank you.

Re: Try and view the source

#3

Post by bri3d » Mon, Mar 19, 2012, 4:53 AM UTC

A clever use of history.replaceState and some special characters (to make it less obvious that the state's been altered) - "view source" in Chrome operates on the currently active URL, which after the replaceState has executed is the "not that easily" page.

You can also reproduce the behavior by navigating back, then forwards again - you'll see the "not that easily" page that way, as well (as the "try and view the source" page has been replaced in your history list).

Re: Try and view the source

#4

Post by bsavas » Mon, Mar 19, 2012, 5:15 AM UTC

Clever trick!

Re: Try and view the source

#5

Post by RugerRedhawk » Mon, Mar 19, 2012, 5:17 AM UTC

Right click: Inspect Element

Re: Try and view the source

#6

Post by lengarvey » Mon, Mar 19, 2012, 5:18 AM UTC

In chrome you can easily view the current source by opening the elements section of Developer Tools.

Re: Try and view the source

#7

Post by p_sherman » Mon, Mar 19, 2012, 5:28 AM UTC

Clever. Ctrl-Shift-I in Chrome.

Re: Try and view the source

#8

Post by adamkhrona » Mon, Mar 19, 2012, 5:38 AM UTC

bri3d wrote: post #3

A clever use of history.replaceState and some special characters (to make it less obvious that the state's been altered) - "view source" in Chrome operates on the currently active URL, which after the replaceState has executed is the "not that easily" page. You can also reproduce the behavior by navigating back, then forwards again - you'll see the "not that easily" page that way, as well (as the "try and view the so…

Just to add to this, the "special characters" are "%E2%80%AE" which is the escaped form of the UTF-8 "Right-To-Left Override" control character (which effectively reverses the display of text).

If you try copying the URL to plain-text, you'll see: http://www.kurlak.com/john/%E2%80%AElmth.ecruos

Re: Try and view the source

#9

Post by DanielRibeiro » Mon, Mar 19, 2012, 5:39 AM UTC

Yes I can view the source: https://gist.github.com/2097197

Re: Try and view the source

#10

Post by sedev » Mon, Mar 19, 2012, 5:40 AM UTC

Flam wrote: post #2

This is why I love NoScript. Viewed it no problems and easily saw what you were doing. Pretty clever trick, thank you.

NoScript is the new antivirus, really.