search

xlak / alphabetic

4 stars 3 forks source link

Thing #9

Closed m1kecraft closed 1 year ago

m1kecraft commented 1 year ago

I made a data URL that can bypass a hapara filter session, which makes you have to be on only a few sites. This data URL tricks hapara into thinking it is mathacademy.com. You can replace the "https%3A//mathacademy.com" with https%3A// then the URL. It opens my duplicate of 3kh0 games.

data:text/html,%3Cscript%3E%0A%20%20%20%20var%20win%3Dwindow.open%28%22https%3A//mathacademy.com%22%29%0A%20%20%20%20win.document.write%28%60%0A%20%20%20%20%3Ciframe%20src%3D%22https%3A//m1kecraf.github.io/echo/projects.html%22%20height%3D%22100%25%22%20width%3D%22100%25%22%3E%3C/iframe%3E%3Cscript%3Ewindow.addEventListener%28%27beforeunload%27%2C%20function%28e%29%7Be.preventDefault%28%29%3Be.returnValue%20%3D%20%27%27%3B%7D%29%3B%3C%5C/script%3E%0A%20%20%20%20%60%29%0A%20%20%20%20window.close%28%29%0A%3C/script%3E

m1kecraft commented 1 year ago

If you want to improve on it or something, tell me.

xlak commented 1 year ago

Nice! The Alphabetic exploit is pretty much just this, but with pages to hide the proxy launcher and code to automatically choose an unblocked proxy site.

xlak commented 1 year ago

By the way, I opened the discussions section on the hapara-delete repo to talk about stuff like this.