Skip to content

Instantly share code, notes, and snippets.

@justusbluemer
Created November 11, 2025 14:46
Show Gist options
  • Select an option

  • Save justusbluemer/ea926ed38b52271506213cb421273a9a to your computer and use it in GitHub Desktop.

Select an option

Save justusbluemer/ea926ed38b52271506213cb421273a9a to your computer and use it in GitHub Desktop.
// change the TARGET variable to "chatgpt", "atlas" etc. and paste to console
// you'll see that you see nothing
(() => {
const TARGET = "atlas";
const results = [];
const seen = new WeakSet();
// Suppress noisy unhandled promise rejections during the scan
const unrHandler = (e) => { e.preventDefault && e.preventDefault(); };
window.addEventListener('unhandledrejection', unrHandler);
function isObjectLike(v) {
return v && (typeof v === "object" || typeof v === "function");
}
// Heuristic: is this object a prototype object (Foo.prototype)?
function isPrototypeObject(o) {
try {
return !!o && Object.prototype.hasOwnProperty.call(o, "constructor") &&
o.constructor && o.constructor.prototype === o;
} catch (_) { return false; }
}
// Collect all property keys visible on obj (own + inherited, once)
function allKeys(obj) {
const keys = new Set();
let p = obj;
while (p && p !== Object.prototype) {
for (const k of Reflect.ownKeys(p)) keys.add(k);
p = Object.getPrototypeOf(p);
}
return [...keys];
}
function scan(obj, path) {
if (!isObjectLike(obj) || seen.has(obj)) return;
seen.add(obj);
let keys;
try { keys = allKeys(obj); } catch (_) { return; }
for (const key of keys) {
const propPath = `${path}${typeof key === "symbol" ? `[${String(key)}]` : `.${String(key)}`}`;
// Find the descriptor from the correct prototype level
let desc, p = obj;
while (p && !desc) {
try { desc = Object.getOwnPropertyDescriptor(p, key); } catch (_) { /* continue */ }
p = Object.getPrototypeOf(p);
}
if (!desc) continue;
let val, haveValue = false;
// If it's a data property, read directly from the descriptor's value
if ("value" in desc) {
val = desc.value;
haveValue = true;
} else if (typeof desc.get === "function") {
// Accessor: only try to read if the receiver is a real instance (not the prototype object itself)
if (!isPrototypeObject(obj)) {
try {
// Use Reflect.get to ensure correct receiver semantics
val = Reflect.get(obj, key);
haveValue = true;
} catch (_) {
// Skip getters that throw/require internal slots we don't have
}
}
}
if (haveValue) {
if (typeof val === "string" && val.includes(TARGET)) {
console.log("FOUND:", propPath, "=>", val);
results.push({ path: propPath, value: val });
}
// Recurse into nested objects/functions/arrays/maps/etc.
if (isObjectLike(val)) {
// Avoid recursing into DOM nodes’ cyclic/huge graphs unless needed
// (still safe; WeakSet prevents cycles)
try { scan(val, propPath); } catch (_) {}
}
}
}
}
// Kick off: current window + same-origin iframes
console.log("Starting deep search for:", TARGET);
try { scan(window, "window"); } catch (_) {}
// Same-origin iframes
if (window.frames && window.frames.length) {
for (let i = 0; i < window.frames.length; i++) {
try {
const w = window.frames[i];
// Accessing location.href will throw on cross-origin; use as probe
void w.location.href;
scan(w, `window.frames[${i}]`);
} catch (_) {
// cross-origin frame; ignore
}
}
}
window.removeEventListener('unhandledrejection', unrHandler);
console.log(`Search complete. Matches: ${results.length}`);
results;
})();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment