Actual un-clickable button (for real this time)!
Disclaimer!
There always has been (and always will be) ways to bypass this since devtools is more powerful than JavaScript itself. Don't expect it to be actually "unclickable"!
After seeing @invisibleOne 's post, I realized that there are soo many ways to bypass the "clicking" for his project.
I decided to take matters into my own hands and actually make my button "un-clickable". None of the methods described in invisibleone's post works now (not even mine)!
See if you can get this button >:)
Oh and BTW:
Calling the function or alerting the message that the function alerts is not counted as the solution. I can't stop liars, but if you find a way around it then please tell me.
People who have clicked the button (legitimately. Those who don't post their reasons or their reasons aren't valid (AKA: they aren't actually clicking it) won't get on the "leaderboard"):
- Wilke000
- 1andonlyaether
- Codemonkey51
- DSAEvan
- darkdarcool
- DrakeFletcher2
Ok so many people are doing it. Great guys!
I'm not going to add any more because so many people are doing it.
I am so proud of you replers! You are all such great critical thinkers!
Keep in mind guys that I can only do so much because most browsers give you more control over JavaScript than JavaScript itself...
Oh, wow
I have found and prevented at least 4 methods of clicking the button via cheats since I made this post:
- Focusing the element using
HTMLButtonElement.prototype.focus() - Mutating
globalThis.requestAnimationFrame - Tabbing/editing the tab index
- Modifying the size/position of the element (to make it stay in one place)
- Right clicking
Ok guys
You now can't use window.alert :D
Ahh, yes. Now I can tell who actually clicked it and who didn't >:)
Yay, we got on trending!!!
Oh and guys... the message saying "lol nice try guys ;D" means you didn't get it.
Fixed the right click hack >:D
(Possibly) also fixed the right clicking address bar cheat :D (button will be disabled. You can click it, but no "You got me!")
Yoo guys, if the button is gray that is on purpose. It's disabled when the web page loses focus (to prevent the right click cheat... which still works ARGH).
You got me guys, I can't defend this button forever :(
hm...
if you wanted it to be unclickable that bad, just give the button the disabled attribute, <button disabled>Cant Click</button> and disable attribute changing.
HTMLElement.prototype.setAttribute = function() { alert("Sike Gottem"); }
this is very good. @ChezCoder
@ChezCoder faxxxxxxxx
@ChezCoder you can bypass this
@ChezCoder you can bypass this
@ChezCoder Ok ez fix >:)
Btw glad to see you back buddy!
Oh, wait... it's already fixed because I froze HTMLButtonElement, so it should prevent setAttribute from being changed... oh wait I forgot to freeze the prototype! Thanks :)
@ChezCoder And yea you could have the disabled attribute, but there is supposed to be a chance to click it without the obvious.
Also, alert won't work cuz it's inside a code block and is not in globals.
@ChezCoder Lmao, HTMLElement#setAttribute actually looks up the prototype until it finds Element#setAttribute ;)
The bypass from there is simple:
Element.prototype.setAttribute.call(button);
JS cannot be sandboxed by itself, it's hell to try.
@ChezCoder Thanks
@xxpertHacker Too, true.. too true.
Can't I delete setAttribute tho?
@Baconman321 I guess?
@xxpertHacker Well, I mean.. imagine if you had even more control (over the client's computer) with JS... it would be a nightmare.
Someone thought they could prevent ending processes in NodeJS (or more or less they were kidding).
@Baconman321 I don't like NodeJS for a thousand reasons, among them, the execution of un-sandboxed JS, with higher privilege than browser JS.
Oh shoot, seems like that sounds like a perfect use case for Wasm though, since it's always safe.
Btw, you need SES in order to sandbox your button... otherwise, I could just assess a new Element from another window if I wanted to.
Actually, no, you just stright-up can't defend that button.
@xxpertHacker Prob not... :(
@Baconman321 ive been fumbling with it for a few minutes now and cant find anything, good job!
@ChezCoder :D
My military strategies have worked well
@ChezCoder Or you can use touchscreen
@Baconman321 make the repl disable the button if the user is on mobile, im sure you can find ways to detect this by searching google :)
@ChezCoder mabe :)
This is kinda ded ngl.
I clicked it!
Edit: the button doesn't move unless you move your mouse first, so memorize where the button 'spawns' and move your cursor there. Then reload the page using a keyboard shortcut.
Yeah this works haha @HackingGo306
Noooo the zoom-in and then zoom-out strategy doesn't work anymore...
@HackingGo306
I used your stratigies to do it lolll
Got it! Go to the project page, hover cursor in the middle of the screen, scroll down, move cursor directly below button, scroll back up (without moving mouse) and click!
@DrakeFletcher2 Also, right-click method still works for me.
@DrakeFletcher2 Hm, try now. it shouldn't work...
I prevented context menu, so it shouldn't bring up the menu for anyone...
@Baconman321 Yeah now it is blocked
Hehehe I on iOS with no access to any js terminal have clicked the button ;)
[ad removed by a moderator]
@Codemonkey51 :O HOW
I have been tapping away at this on my iPad and it hasn't worked
Idk how @RayhanADev
@Codemonkey51 :O
magic
-cough- literally just dragged my mouse out scrolled down and clicked it lol
I got it first try. LOL!
ill make a actual unclickable button. no tab spoofing or reload clicking or that stuff. ill make it truly unclickable
@AntimatterDev Not really possible, but ok!
The button will always be clickable :/
@Baconman321 maybe your definition of clickable is different than mine. what is your definition of clickable?
@AntimatterDev Able to be clicked.
If you make it in JavaScript then the client user will almost always have more power over the program than JavaScript itself.
Like xxpertHacker said, it's hell to try to sandbox JavaScript
@Baconman321 what is sandboxing javascript?
@AntimatterDev https://stackoverflow.com/questions/7043882/what-actually-is-sandboxing-in-javascript
Basically trying to lock out external resources from meddling with the script.
In this case, trying to prevent the user from editing the code.
@Baconman321 oh thats decently simple. you just have to make it so that none of the elements appear on inspect
ok i fixed reload spoofing
and to fix the thing of moving faster than it can detect i just stopped the button moving with your mouse
@AntimatterDev That's not rlly possible...
@Baconman321 whats not possible?
fixing reload spoofing?
i also fixed inspect opening using keyboard shortcuts
@AntimatterDev That's not possible, actually.
@Baconman321 whats not possible?
idk what your saying is impossible but ive done everything ive said ive done. its actually really simple.
@AntimatterDev You can't prevent inspecting.
They can always open up chrome://inspect or the browser's inspect URL/command.
@AntimatterDev I can still open up inspect :)
@Baconman321 on mine? how did u do it?
how do you use chrome://inspect. like how would you point it towards the webpage your trying to inspect
@AntimatterDev chrome://inspect allows you to inspect any process running on the chrome browser. It's a local address, so you just type it into the address bar (in a new tab).
@Baconman321 ok should be blocked now
@Baconman321 hmm ill try and see if i can block that
ok i found a solution that might work to try and block devtools brb
@AntimatterDev You can't lol.
okie i cant test if they are blocked rn because im on my school pc
@AntimatterDev You can't block devtools, it's impossible.
You can set an interval to trigger debugger;.
When they open up the the devtools it will constantly throw the debugger.
That's the closest you can do to stopping devtools AFAIK.
@AntimatterDev It's just not possible, you can't block something that has more control over your program :/
@Baconman321 are you sure? maybe you arent looking at all the options
maybe a handy little module called devtoole-detect?
@AntimatterDev Nope.
You can't stop devtools, period.
If you want some more answers/opinions, please post on ask instead of asking me here.
@Baconman321 i will prove you wrong as best i can just you wait
@AntimatterDev You can't block them from opening devtools on your website!
@xxpertHacker can verify this (srry for ping but xxpertHacker this guy here is like "I can prevent something that has more power over my program")
@Baconman321 maybe i cant stop you from opening it but what about stopping people from using it?
@Baconman321 😂 I read the entire conversation, it's funny to see people say what they w
will do, instead of just doing it.
such as if they open it it detects it and self destructs the webpage stopping them from doing anything to it
@xxpertHacker im on a school pc rn so i cant do it rn but i think ive almost got a working prototype before i push it to my own version of this
@AntimatterDev Again, not possible.
Still, you could try for those less experienced (I haven't found a way around it yet, but that doesn't mean there isn't a way):
window.setInterval(_ => (debugger), 1);
@xxpertHacker Devtools can't be "blocked" tho, right?
@Baconman321 you could just send alerts constantly to stop people from being able to edit anything on the page
@Baconman321 im not saying to block it im saying to make it unusable
@AntimatterDev Ping me when you think that it's done, so I can break it ;)
@xxpertHacker ok i will :). keep in mind that im only a highschooler and im only decent at coding
@AntimatterDev @xxpertHacker it's nice and all that you guys are trying to take my button to the next level and try to break it and such, but could you continue this somewhere where I don't get pinged every time you make a message?
Kinda annoying ngl.
It is easy without cheating, just right click and all those options pop up. Then click the button itself and press enter.
Debunker!!
srry
lol yea thats what i did @DSAEvan
Yeah me too!
@Wilke000 That's not the actual message. That's the message of the disabled window.alert...
I had a bug with it always displaying that message tho...
@DSAEvan @BobTheTomatoPie HaHa, fixed now :D
@Wilke000 Hmmmm... how exactly?
By clickng @Baconman321!
@Wilke000 Yes, but how?
You can't just "click" most of the time...
This @Baconman321 I am on a Chromebook, I double click
Sneaking through the crack......
@Wilke000 I have an idea on how to prevent that :D
:0 @Baconman321 YAY!!
I CLICKED THE BUTTON!!!
ALso, please put NAMES
@Baconman321
@Wilke000 Ok...
Thank you @Baconman321
Yay!
I am going to end up wasting a whole class with this. I hate you ;).
its kinda easy to get if u have a computer with touchscreen
all u have to do is spam click and touch with ur finger
@AshtonHill1 Yeah.
HoW...
@bot111222 It might be disabled by your orginization.
tauch screeeeennnnn >:)
bro i cant inspect it
i bypassed window.alert lol
I clicked it... I put my mouse above it "offscreen" then scrolled down to it and clicked. Basically what @ChezCoder did
I GOT IT WOOOOOOOO!!!!!!
used the right clicking on the the search bar hack.
is there a correct way or we just usin all the hax
@JasonMathew prob hax.
I can't control the browser itself, which is why you can click it.
So is there a 'proper' solution or is hax the point?
@JasonMathew Just hax :(
I mean, if you move your mouse around fast enough and click, you might get it. But there is no definite proper solution, so yeah just hax for the most part.
@baconman321 omg congrats idek
@SamiOsman :D
Unfortunately that is invisibleone's repl, not mine. Still tho, :D
@Baconman321 Oh shoot sorry but guess what... now congrats!
@Baconman321 :D Congrats Lol!
i win
I turned my mouse speed up a bunch and managed to click it, but it wouldn't do anything.
https://drive.google.com/file/d/1yF-NXHh_Lb2yNWBg0BagOCYsh3sVlMAn/view?usp=sharing
(that's a screen recording of my WHOLE screen)
@M07 Yeah, the button is glitched right now. I have other things to do though, this project is kind of dead. I'll take out the feature that stops you from clicking while not focusing on the webpage because it's buggy :(
Why is it impossible? I can get my mouse on the button by moving it really fast and then it just gets grayed out! I can get my mouse on it (without cheating) and then it doesn't do anything :( please fix!
@savageking65200 Unfortunately this project is dead.
I might fix it later on :/
Oh, plus it turns grey when you go out of the window. IDK why it would gray out when you go over the button. I'll look into that eventually (I have many other things to do. If you want to fix it yourself right away then just fork it :/)
i clicked it ez
go on a tablet, click the button, no devtool needed :D i did that
@StringentDev This be a ded project :/
I cliked but it didn't work
@mordyman Uhhh, it's disabled probably because the webpage lost focus.
@Baconman321 o ok
HELP ME I DONT UNDERSTAND!!!!
@SamiOsman It disables when you move your mouse outside of the web page.
@Baconman321 But if you look closely, my cursor was on the button :(.
@SamiOsman Oh....
IDK then :(
@Baconman321 Ok :(
wonderful
I clicked it, with my finger xD
something turned blue for me
ive figured out a way to hover over it and keep it red but it just greys out when i click so i dont think it is possible to click
nevermind i got it
ps for anyone who wants do do it just press ctrl+r to reload and hover your mouse over the button
Very relevant...
@RyanShrey1 LOL!
SO TRUE!
Btw I love science as well...
xkcd. Very funny.