Skip navigation.

More on VBScript

There's ways to execute visual basic scripts without the need of saving a vbscript to a file.

However use this with extreme caution, as pages redirecting to .vbs scripts can be directly run too...

button

Heres the code in the data uri.

DIM Wsh
Set Wsh = WScript.CreateObject("WScript.Shell")
Wsh.SendKeys "^s{TAB}{DOWN}{DOWN}{DOWN}{ENTER}+{TAB}"
Set Wsh = nothing
WScript.Quit


This is a custom button which defaults to "save as web archive".

However it won't work at first go.

So first, drag the button to a toolbar, and click on it, then a download dialog will appear.

Then click "Change.." , enter "vbs"(without quotes) in the "File Extensions" field, then click radio button "Open with default application" then click "OK". Next time you click the button it will open the "Save as" dialog with default dropdown to "Web archive (single file)".

Either use this at extreme caution, or save this file below(right click > Save target as, if you have already set the above, and save it somewhere)
saveasarchive.vbs

Then use this code.

Execute program,"path/to/where/you/saved/saveasarchive.vbs",,"Save","Save document"


Replace the "path/to/where/you/saved/" with the direct path to your vbs file.
And input it into a button maker.

http://nontroppo.org/tools/buttonmaker/ , enter the code into the "OR just write the action as plain text:" field and click "Create button".

And you're done.

My Top 5 wishes for Opera.Bookmarklet to view forms properties and elements.

Comments

Lex1 7. August 2007, 22:45

Interesting but useless idea. Such hole in security is not present even in IE.

shoust 7. August 2007, 23:12

FWIW I tried earlier to use a php to set the same mime-type (text/vb-script) and redirect to a .vbs script on server.

http://h1.ripway.com/shoust/test.php

Returns a "file not found". Maybe it doesn't auto-download those files after all. Tested it on local and it works ok there, i think the only way to spoof it would be someone would redirect to a data uri containing the text/vb-script mimetype. Which really wouldn't be worth it in the end anyway.

Lex1 8. August 2007, 09:49

i think the only way to spoof it would be someone would redirect to a data uri containing the text/vb-script mimetype.


I agree.

or save this file below


QSaver better :wink: (I think, Readme.html will be interestingly you. In the buttons, complete way written via javascript)

Write a comment

You must be logged in to write a comment. If you're not a registered member, please sign up.