12

This website (www.samy.pl) uses some technique so that no one can inspect the code
(Ctrl+Shift+I) or view source (Ctrl+U). It can detect if you have opened the console or inspector the code automatically changes.

How this is possible?

MarianD
  • 13,096
  • 12
  • 42
  • 54
TPS kisan
  • 129
  • 1
  • 5
  • 1
    Possible duplicate of [How to hide html source & disable right click and text copy?](http://stackoverflow.com/questions/6597224/how-to-hide-html-source-disable-right-click-and-text-copy) – Adam Apr 12 '17 at 23:27
  • @Adam No, it's not the same as that site. – Barmar Apr 12 '17 at 23:28
  • Press F12 to open your console. Use IE11 to fool their script. – yezzz Apr 12 '17 at 23:28
  • what about if i goto More Tools>Developers Tools or (ctrl+shift+i) option on chrome this website redirect to another page so that no one can see the code of homepage. How to do it then? – TPS kisan Apr 12 '17 at 23:32
  • The site somehow detects when you open the console, and the source changes. – Barmar Apr 12 '17 at 23:32
  • have you tried it @yezzz – TPS kisan Apr 12 '17 at 23:33
  • yep I tried. Works, just IE11 is old and the dev tools are horrible to work with. Might want to try Edge. BTW, in chrome: press F12, then in dev tools shift+ctrl+M to get the mobile view... it will show some elements of the site. – yezzz Apr 12 '17 at 23:37
  • Nope, sorry that was samy.pl/code. IE11 works though – yezzz Apr 12 '17 at 23:39
  • Edge works too. Developer console and everything – jrook Apr 12 '17 at 23:46
  • How can I do this to my website? – TPS kisan Apr 13 '17 at 00:00
  • Duplicate of [Detect when “Inspect Element” is open](http://stackoverflow.com/questions/42193700/detect-when-inspect-element-is-open/42194142#42194142) – FlightOfGrey Apr 19 '17 at 23:25
  • Ctrl-U Works every single time ¯\_(ツ)_/¯ Are you using Firefox? It dosent work on chrome. – Keraz Jun 01 '19 at 01:33
  • I found [this on Reddit](https://www.reddit.com/r/webdev/comments/67ch5v/how_is_this_site_done/). – Marc.2377 Sep 22 '19 at 03:57

10 Answers10

4

You could always save the website. In chrome open the menu -> more tools -> Save page as..

You should be able to run the html file in chrome, and use Dev Tools without it blocking you.

Fio
  • 79
  • 7
  • It would still be blocked because the code is what is being downloaded and is what is blocking it. But you WILL be able to open it in a text editor to view the code. – Cameron Apr 12 '17 at 23:51
  • 1
    Yeah opening the file to see the code actually works! – Cameron Apr 13 '17 at 00:03
3

There is a console "clearing" API that is mentioned in this answer.

Here's what I think is happening:

First, I think Google Chrome DevTools emits an event when it is open/launched. The page author listens for this 'launch' event with the following handler logic:

  1. Run a chrome.devtools.inspectedWindow.eval DevTools inspection API
  2. Set document.body.innerHTML to the winky-face div
  3. Also, a setInterval that executes a console.clear() before the console.log() of "no source for you".

I also inspected the EventListeners tab of Chrome DevTools while reading the "no source for you"-page.

Unfortunately, the two event listeners you can view don't seem to do anything useful:

  • one returns false
  • the other wires together forms and their associated submit actions.

Hope this helped

Community
  • 1
  • 1
stephenjfox
  • 86
  • 3
  • 8
  • 1
    So they also clear their script tags, and remove any event listeners and/or callbacks that mess with the console. – yezzz Apr 13 '17 at 11:29
3

hahaha, this is a good one, you should not expect less from samy!

Now I see why people think it is the wrong answer (the source get replaced if you do otherwise)

1.Navigate to site with inspector open there you end up with "No source for you! You found easter egg #7."

2.and then check the source to find Easter egg #2:

view-source:https://samy.pl

you will see:

/*
No source for you! Easter egg #2
*// AFTER SOME LONG WHITE SPACES HERE  /.source.replace(/.{7}/g,function(w){document.write(String.fromCharCode(parseInt(w.replace(/ /g,'0').replace(/   /g,'1'),2)))});

This is the way he loads the site(by injecting js), by replacing two type of white spaces for 1 and 0 and parsing that to char code by some regex and then that to string of course :D

https://de.wikipedia.org/wiki/Whitespace_(Programmiersprache)

If you paste that part to a js console, you will get the tags that loads the page.

enter image description here

ps. to see the rendered source, just load the page normaly and hit F12 after disabling javascript.

Have fun!

pabbasian
  • 89
  • 11
  • This is no longer valid. – Michał Miszczyszyn Jun 18 '19 at 22:26
  • " ... – pabbasian Jun 25 '19 at 10:17
1

Create an index.html somewhere, containing an <iframe src='https://samy.pl/'>. Load it in your browser and then open devtools. You will see the source inside the iframe.

Nadal Gonzalo García Zavala
  • 11
  • 1
0

Update: Go to view-source:http://samy.pl which is the link of what the view source right click brings you to. It only works on Chrome I think.

If you are using chrome, go to the menu at the top right. Then go to more tools, and click developer tools.

Cameron
  • 1,049
  • 12
  • 24
0

After a lot of tinkering and speculating together, my roommate succeeded in the end with quite a naïve approach.

Simply open the Chrome devtools and copy out the source before it gets replaced. Giving Chrome processes low priority and doing some heavy-lifting with your CPU (compilation or other) helps.

Chop, chop.

Viktor Sec
  • 2,756
  • 1
  • 24
  • 31
0

Ah! I have found an extremely easy way to do it.
1. Open Firefox (Chrome only shows you part of it).
2. In the URL bar, type in javascript:alert(document.documentElement.outerHTML);
3. Press Enter.
4. Voilà!

CerebralDatabank
  • 41
  • 1
  • 6
0

New Way to find the source code! But its complicated!
Open a new tab.
Open Devtools (Inspect Tab)
Click On Toggle Device toolbar (the mobile like icon)

Click on "No Throttling" to slow down the page loading time

Select "Low - Tier Mobile"

Open the page! When you see the icons appear on the page, you can now see the source code! :)

Mafee7
  • 47
  • 4
0

sorry very late but i think i have the answer

He used this node package to which he has contributed and forked too

the package docs say that it wont work if the devtools are undocked

AdityaInfinite
  • 1
  • 1
  • 3
-2

You can simply use the developer tools in almost all the browsers. Just Press F12 and the developer tools section will be there.

Thanks

Harsheet
  • 728
  • 9
  • 23
  • That might also be blocked by the code on the website because if right click is blocked, and those keyboard commands are blocked, then F12 is probably blocked too. – Cameron Apr 12 '17 at 23:41
  • F12 does work, it brings the dev tools, but the site detects this and loads other content. Sites have limited control over browsers. Why do you think they're limiting js xss. – yezzz Apr 12 '17 at 23:46