1

I want to inject JavaScript to a website locally via address bar. The purpose is to make some modifications of the website only for me.

What is the correct way to find and then manipulate objects / variables? Especially when the JS is obfuscated.

Say, I know for sure there has to be an instance of a certain class which has a certain method. F12 both on Chrome and on FF did not help me too much but maybe I am doing something wrong.

To be more precise, I will give a real problem. This website is an open source chess server. It uses an open source library to represent a board (github). I know for sure that there has to be a move() method.

Now the question is simple: how do I find this instance and calling move() in order to programmatically move pieces?

closed as off-topic by Steffen Ullrich, AndrolGenhald, forest, multithr3at3d, Teun Vink Jul 29 '18 at 19:11

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, AndrolGenhald, forest, multithr3at3d, Teun Vink
If this question can be reworded to fit the rules in the help center, please edit the question.

  • you might not be able to; it's possible to execute JS in a pure local context, ex inside an IIFE or module, with DOM subscriptions inside the wrapper. you would be better off using tampermonkey that the URL bar, which would be a total PITA to debug/dev – dandavis Jul 23 '18 at 16:55
  • @dandavis, and what if I make changes to the browser settings? On what level I might not be able to? On browser level or it is a limitation of the interpreter? – Ders Jul 23 '18 at 17:29
  • 3
    I fail to see how this is a question about information security, i.e. I consider it off-topic. – Steffen Ullrich Jul 23 '18 at 17:31
  • its a limit of the language. you would have to hack V8. that said, you can simulate human interaction, so that you can "click" on the board and the program will behave as expected. not as cool as getting into the code, but universally possible. – dandavis Jul 23 '18 at 20:33

Browse other questions tagged or ask your own question.