Skip to content
Sign upLog in
← Back to Community

Actual un-clickable button (for real this time)!

Profile icon
Baconman321

Disclaimer!

There always has been (and always will be) ways to bypass this since devtools is more powerful than JavaScript itself. Don't expect it to be actually "unclickable"!


After seeing

@invisibleOne
's post, I realized that there are soo many ways to bypass the "clicking" for his project.

I decided to take matters into my own hands and actually make my button "un-clickable". None of the methods described in invisibleone's post works now (not even mine)!

See if you can get this button >:)

Oh and BTW:

Calling the function or alerting the message that the function alerts is not counted as the solution. I can't stop liars, but if you find a way around it then please tell me.

People who have clicked the button (legitimately. Those who don't post their reasons or their reasons aren't valid (AKA: they aren't actually clicking it) won't get on the "leaderboard"):

  • Wilke000
  • 1andonlyaether
  • Codemonkey51
  • DSAEvan
  • darkdarcool
  • DrakeFletcher2

Ok so many people are doing it. Great guys!

I'm not going to add any more because so many people are doing it.

I am so proud of you replers! You are all such great critical thinkers!

Keep in mind guys that I can only do so much because most browsers give you more control over JavaScript than JavaScript itself...

Oh, wow

I have found and prevented at least 4 methods of clicking the button via cheats since I made this post:

  • Focusing the element using HTMLButtonElement.prototype.focus()
  • Mutating globalThis.requestAnimationFrame
  • Tabbing/editing the tab index
  • Modifying the size/position of the element (to make it stay in one place)
  • Right clicking

Ok guys

You now can't use window.alert :D

Ahh, yes. Now I can tell who actually clicked it and who didn't >:)

Yay, we got on trending!!!

Oh and guys... the message saying "lol nice try guys ;D" means you didn't get it.

Fixed the right click hack >:D

(Possibly) also fixed the right clicking address bar cheat :D (button will be disabled. You can click it, but no "You got me!")

Yoo guys, if the button is gray that is on purpose. It's disabled when the web page loses focus (to prevent the right click cheat... which still works ARGH).

You got me guys, I can't defend this button forever :(

Voters
Profile icon
hueychen27
Profile icon
DividedFox
Profile icon
Classfied3D
Profile icon
89degrees
Profile icon
Navinor
Profile icon
MikeW3
Profile icon
SumaitaAlam
Profile icon
SeamusDonahue
Profile icon
svensk007
Profile icon
OldWizard209
Comments
hotnewtop
Profile icon
RyanShrey1

Very relevant...

image

Profile icon
Baconman321

@RyanShrey1
LOL!

SO TRUE!

Btw I love science as well...

Profile icon
robertoblong

xkcd. Very funny.

Profile icon
ChezCoder

hm...
hm

if you wanted it to be unclickable that bad, just give the button the disabled attribute, <button disabled>Cant Click</button> and disable attribute changing.

HTMLElement.prototype.setAttribute = function() { alert("Sike Gottem"); }
Profile icon
sojs

this is very good.

@ChezCoder

Profile icon
RayhanADev

@ChezCoder
faxxxxxxxx

Profile icon
Ayoubuvin1

@ChezCoder
you can bypass this

Profile icon
Ayoubuvin1

@ChezCoder
you can bypass this

Profile icon
Baconman321

@ChezCoder
Ok ez fix >:)

Btw glad to see you back buddy!

Oh, wait... it's already fixed because I froze HTMLButtonElement, so it should prevent setAttribute from being changed... oh wait I forgot to freeze the prototype! Thanks :)

Profile icon
Baconman321

@ChezCoder
And yea you could have the disabled attribute, but there is supposed to be a chance to click it without the obvious.

Also, alert won't work cuz it's inside a code block and is not in globals.

Profile icon
xxpertHacker

@ChezCoder
Lmao, HTMLElement#setAttribute actually looks up the prototype until it finds Element#setAttribute ;)

The bypass from there is simple:

Element.prototype.setAttribute.call(button);

JS cannot be sandboxed by itself, it's hell to try.

Profile icon
Yoplayer1py

@ChezCoder
Thanks

Profile icon
Baconman321

@xxpertHacker
Too, true.. too true.

Can't I delete setAttribute tho?

Profile icon
xxpertHacker

@Baconman321
I guess?

Profile icon
Baconman321

@xxpertHacker
Well, I mean.. imagine if you had even more control (over the client's computer) with JS... it would be a nightmare.

Someone thought they could prevent ending processes in NodeJS (or more or less they were kidding).

Profile icon
xxpertHacker

@Baconman321
I don't like NodeJS for a thousand reasons, among them, the execution of un-sandboxed JS, with higher privilege than browser JS.

Oh shoot, seems like that sounds like a perfect use case for Wasm though, since it's always safe.


Btw, you need SES in order to sandbox your button... otherwise, I could just assess a new Element from another window if I wanted to.

Actually, no, you just stright-up can't defend that button.

Profile icon
Baconman321

@xxpertHacker
Prob not... :(

Profile icon
ChezCoder

@Baconman321
ive been fumbling with it for a few minutes now and cant find anything, good job!

Profile icon
Baconman321

@ChezCoder
:D

My military strategies have worked well

Profile icon
TinyMooshmallow

@ChezCoder
Or you can use touchscreen

Profile icon
ChezCoder

@Baconman321
make the repl disable the button if the user is on mobile, im sure you can find ways to detect this by searching google :)

Profile icon
Baconman321

@ChezCoder
mabe :)

This is kinda ded ngl.

Profile icon
HackingGo306

I clicked it!

Edit: the button doesn't move unless you move your mouse first, so memorize where the button 'spawns' and move your cursor there. Then reload the page using a keyboard shortcut.

Profile icon
Aqtion

Yeah this works haha

@HackingGo306

Profile icon
HackingGo306

Noooo the zoom-in and then zoom-out strategy doesn't work anymore...

Profile icon
Plorzon

@HackingGo306

I used your stratigies to do it lolll

Profile icon
DrakeFletcher2

Got it! Go to the project page, hover cursor in the middle of the screen, scroll down, move cursor directly below button, scroll back up (without moving mouse) and click!

Profile icon
DrakeFletcher2

@DrakeFletcher2
Also, right-click method still works for me.

Profile icon
Baconman321

@DrakeFletcher2
Hm, try now. it shouldn't work...

I prevented context menu, so it shouldn't bring up the menu for anyone...

Profile icon
DrakeFletcher2

@Baconman321
Yeah now it is blocked

Profile icon
Codemonkey51

Hehehe I on iOS with no access to any js terminal have clicked the button ;)

image

Profile icon
Mrunank

[ad removed by a moderator]

Profile icon
Wilke000

It's great

@Mrunank
! But no ads

Profile icon
RayhanADev

@Codemonkey51
:O HOW
I have been tapping away at this on my iPad and it hasn't worked

Profile icon
Codemonkey51

Idk how

@RayhanADev

Profile icon
RayhanADev

@Codemonkey51
:O
magic

Profile icon
Mrunank

@Wilke000
I am sorry

Profile icon
DerpBurgerPlayz

image

-cough- literally just dragged my mouse out scrolled down and clicked it lol

Profile icon
UnluckyFroggy

I got it first try. LOL!

Profile icon
AntimatterDev

gru


ill make a actual unclickable button. no tab spoofing or reload clicking or that stuff. ill make it truly unclickable

Profile icon
Baconman321

@AntimatterDev
Not really possible, but ok!

The button will always be clickable :/

Profile icon
AntimatterDev

@Baconman321
maybe your definition of clickable is different than mine. what is your definition of clickable?

Profile icon
Baconman321

@AntimatterDev
Able to be clicked.

If you make it in JavaScript then the client user will almost always have more power over the program than JavaScript itself.

Like xxpertHacker said, it's hell to try to sandbox JavaScript

Profile icon
AntimatterDev

@Baconman321
what is sandboxing javascript?

Profile icon
Baconman321

@AntimatterDev
https://stackoverflow.com/questions/7043882/what-actually-is-sandboxing-in-javascript

Basically trying to lock out external resources from meddling with the script.

In this case, trying to prevent the user from editing the code.

Profile icon
AntimatterDev

@Baconman321
oh thats decently simple. you just have to make it so that none of the elements appear on inspect

Profile icon
AntimatterDev

ok i fixed reload spoofing

Profile icon
AntimatterDev

and to fix the thing of moving faster than it can detect i just stopped the button moving with your mouse

Profile icon
Baconman321

@AntimatterDev
That's not rlly possible...

Profile icon
AntimatterDev

@Baconman321
whats not possible?

Profile icon
AntimatterDev

fixing reload spoofing?

Profile icon
AntimatterDev

i also fixed inspect opening using keyboard shortcuts

Profile icon
Baconman321

@AntimatterDev
That's not possible, actually.

Profile icon
AntimatterDev

@Baconman321
whats not possible?

Profile icon
AntimatterDev