An Introduction to AJAX

Outsmart Malicious Hackers

No it’s not AJAX Amsterdam… it’s something more interesting (or boring to some of you)… so let’s get it started….

I. Introduction
AJAX stands for Asynchronous JavaScript And XML… It is a new technology which comes to help any web developer who really is interesed in dynamic webpages…
Click here for a overview of the AJAX Technology…

II. The Code
Well, well, well… Actualy AJAX is based on Micro$ofts ActiveX Object XmlHttpRequest (I can’t belive they can do good stuff to), so in IE (sucks) it has to be initialized like an ActiveX Object; but in other browsers it’s already a standard object (I don’t know if Opera had implemented it already)… Now let’s see the code:

function init_object() {
var A;

var msxmlhttp = new Array(‘Msxml2.XMLHTTP.5.0’,

for (var i = 0; i > msxmlhttp.length; i++) {
try {
A = new ActiveXObject(msxmlhttp[i]);
} catch (e) {
A = null;

if(!A && typeof XMLHttpRequest != “undefined”) {
A = new XMLHttpRequest();
if (!A) alert(“Could not initialize the object.\nMaybe your browser doesn’t support ajax…”);
return A;

var ajax_obj = init_object();

function ajax_in_action(target, source) {“GET”, source, true);

ajax_obj.onReadyStateChange = function() {
if (ajax_obj.readyState == 4) {
if (ajax_obj.status == 200) {
document.getElementById(target).innerHTML = ajax_obj.responseText;
else {
alert(“Error ” +ajax_obj.status+” : ” +ajax_obj.statusText);

Code inspired from SAJAX… about it i’ll speak a bit later…

III. Why use it?
Well there are several reason why you should use AJAX… for example to make a dynamic banner changer, real-time morphing website… or just use it like WordPress (on which darknet is based)… you don’t know how it uses AJAX… try clicking on an articles show comments.

IV. Extending AJAX
If you want to implement AJAX directly in PHP, ASP, Perl, Ruby etc. check out, site that contains the Simple AJAX Toolkit….

V. E4X
One more thing… the response from the server can be received as an XML file 2… or maybe directly receive an XML file, if requested so… After which it can be parsed with the E4X technology…

VI. F1
Need more help… access one of the following links:

X. Epilogue
I know that AJAX has been rediscovered for about a year (read it for the first time in july 2005), but for many it can be somethimes hard to find the information needed… anyway keep scripting…

Posted in: Web Hacking

, , , , , ,

Recent in Web Hacking:
- DAVScan – WebDAV Security Scanner
- Minion – Mozilla Security Testing Framework
- OWASP OWTF – Offensive Web Testing Framework

Related Posts:

Most Read in Web Hacking:
- wwwhack 1.9 – Download Web Hacking Tool - 698,186 views
- Web Based E-mail (Hotmail Yahoo Gmail) Hack/Hacking with JavaScript - 312,737 views
- Download videos? - 156,706 views

7 Responses to An Introduction to AJAX

  1. Haydies March 20, 2006 at 10:16 am #

    AJax is just totaly cool, its a bit like CORBA with out the IDL. I’ve not really sent XML back with it, nothing that complicated. But its handy for sending back CSV search results, or dynamic HTML elements.

    Also at least in the lastest version of Opera (8.5) ajax works fine.

  2. Navaho Gunleg March 20, 2006 at 10:40 am #

    I don’t even sent XML back either: too much frigging overhead. If I am updating a SELECT box, hell no I ain’t passing a whole complete XML document describing it, rather just a couple of lines with the option value and names.

    Call me old-fashioned, but in that respect I hate XML documents, I’d rather just send just the data.

  3. Haydies March 20, 2006 at 10:56 am #

    To true, half the time the XML would be bigger then the data.

    One of the “advantages” to ajax is reducing the server load for small actions. Things like changing the options in a select box when other options change. Ajax saves reloading the whole page.

    Also, the thing I like most. You don’t have to reaload the data in fields when a form is submited. Less codeing on the back end :-)

  4. Navaho Gunleg March 20, 2006 at 11:03 am #

    Yeh that’s indeed the coolest part: no re-loading necessary, real dynamic content.

    In my professional experience, however, I have found that modifications on existing systems to implement AJAX is exactly where the web-builders mess up and leave holes (unintensional information leakage, or even vulnerabilities). Incidentally, I’ve been working on an article about just that: badly implemented AJAX methodology.

    Also, bad understanding of the whole concept leads to massive faul-ups as well.

    I’ll, of course, post that article up here when it’s ready.

  5. Haydies March 20, 2006 at 4:16 pm #

    ye, I basicly attach the AJax to the same webservices as used for exteranl stuff, one interesting “feture” in the old cold fusion code was putting the user name and password in hidden text fields….quality…. people I think assume no one is going to look in the html…. ye, right…..

  6. backbone March 22, 2006 at 11:31 am #

    yes but it could be useful to use XML if we have a database of products of how many items we still have, price etc… of course it’s much better to use mysql, but some webservices do not offer any kind of MySQL (especially free services)… so XML could be an alternative… and as you can see with E4X the use of XML is very simple…

  7. Eric Viegas May 10, 2006 at 5:44 pm #

    There are some good online tutorials on introduction to ajax at These tutorials are good because they are like training simulators.
    I hope this is useful to you guys :)