The HTA applications

Abhishek Dwivedi · 08-01-2008, 04:24 PM

The HTA Applications

Introduction: HTA applications are one of the most dangerous (atleast I think so) part of Web Designing. HTA’s are basically a cross between the Web-Pages and Executable files. With the help of HTA, it is now possible to make a complex application to work on the web without making an .exe of it!

Security: HTA’s are no doubt useful but it also has a darker side. The HTA applications are big threat to system security as they provide full access to the system resources without any warning or checking any security settings of the browser. IN SHORT, IT WORKS AS A TRUSTED APPLICATION.
The Good part of HTA is that it does not open as a Webpage on the web but asks the user to either RUN or SAVE it.

Few Programs: (only ie4 and above support HTA)

Making folder:
<html>
<head>
<HTA:APPLICATION ID="htapp">
</head>
<body>
<object id=wsh classid=clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B></object>
<script language=vbscript>
set wshshell=createobject ("wscript.shell")
a=wshshell.run("cmd.exe /c md abhishek",0)
</script>
Folder made!
</body>
</html>

When you save the above code as name.hta and execute it, a window will open with FOLDER MADE! written on it and a new folder will be created at the same location where the HTA file is kept.

Now remove <HTA:APPLICATION ID=”htapp”> from the above code and save it as name.html and now run it. Now you will be able to see the difference between HTA and HTML Applications.

Web Browser:
<html>
<head>
<title>Abhi Internet Browser</title>
<HTA:APPLICATION APPLICATIONNAME="Abhi Internet Browser" Windowstate="normal" sysmenu="yes">
</head>
<body>
<span id=abar style="overflow none">
<span id=AText><b>URL:</b></span>
<input type=text value="" id=URL width="60" style="width:expression(document.body.clientWidth-AText.offsetWidth - AGo.offsetWidth -85)">
<input type=button value="Go" id=AGo onclick="navigate()"><br>
<span>
<br>
<iframe src="techabhi.wordpress.com" id=data style="width:100%;height:85%"></iframe>
<script language=jscript>
function navigate()
{
document.all.data.src=URL.value;
}
function clickshortcut()
{
if (window.event.keycode==13){ navigate() }
}
URL.onkeypress=clickshortcut;
</script>
</body>
</html>

Now save this code as name.hta and run it. You can see a small web browser has been made and it can even access you HDD when you type x:\ and press GO button.
Now save this file as name.html and run it. You can still see the address bar and the GO button but you will not be able to surf the web nor access your HDD until you allow the scripts and active-X to run through your browser.
This means that you can very well view the non-scripted part of the HTA on web browsers but not the scripted part.

Conclusion: I request everyone, who have read this article, not to misuse the above provided code as I have tried to explain my point with these code and they are meant only for educational purpose. Hope you guys like it...

anarkiLeo · 09-01-2008, 02:29 PM

Nice one Abhishek... thanks for sharing..keep it up.... can you recommend me some websites or some pdf docs on HTA technology.

Abhishek Dwivedi · 09-01-2008, 05:08 PM

thx for da sweet comment anarkiLeo...try googling for HTA applications...u'll find a lot of data...i personaly do not have any ebook on da topic...

**topgear** · 09-01-2008, 05:27 PM

Thanks Abhishek Dwivedi

14-01-2008, 01:32 PM

Thanks Abhishek Dwivedi

Masroor · 22-01-2008, 03:43 PM

nice, but the browser is not runing fast.... why???

Abhishek Dwivedi · 22-01-2008, 07:23 PM

well...dat is not a fully loaded web browrer...its just a small HTA app so u can expect much frm it...its gud when u got nuthing...lolz

Masroor · 03-02-2008, 09:55 AM

Nice!. but the browser is not working.

Abhishek Dwivedi · 07-02-2008, 03:29 PM

i can't understand u...chk da code...it shud wrk...

08-01-2008, 04:24 PM	#1 (permalink)
Abhishek Dwivedi TechFreakiez.com Join Date: Sep 2006 Location: New Delhi Posts: 621	The HTA applications The HTA Applications Introduction: HTA applications are one of the most dangerous (atleast I think so) part of Web Designing. HTA’s are basically a cross between the Web-Pages and Executable files. With the help of HTA, it is now possible to make a complex application to work on the web without making an .exe of it! Security: HTA’s are no doubt useful but it also has a darker side. The HTA applications are big threat to system security as they provide full access to the system resources without any warning or checking any security settings of the browser. IN SHORT, IT WORKS AS A TRUSTED APPLICATION. The Good part of HTA is that it does not open as a Webpage on the web but asks the user to either RUN or SAVE it. Few Programs: (only ie4 and above support HTA) Making folder: <html> <head> <HTA:APPLICATION ID="htapp"> </head> <body> <object id=wsh classid=clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B></object> <script language=vbscript> set wshshell=createobject ("wscript.shell") a=wshshell.run("cmd.exe /c md abhishek",0) </script> Folder made! </body> </html> When you save the above code as name.hta and execute it, a window will open with FOLDER MADE! written on it and a new folder will be created at the same location where the HTA file is kept. Now remove <HTA:APPLICATION ID=”htapp”> from the above code and save it as name.html and now run it. Now you will be able to see the difference between HTA and HTML Applications. Web Browser: <html> <head> <title>Abhi Internet Browser</title> <HTA:APPLICATION APPLICATIONNAME="Abhi Internet Browser" Windowstate="normal" sysmenu="yes"> </head> <body> <span id=abar style="overflow none"> <span id=AText><b>URL:</b></span> <input type=text value="" id=URL width="60" style="width:expression(document.body.clientWidth-AText.offsetWidth - AGo.offsetWidth -85)"> <input type=button value="Go" id=AGo onclick="navigate()"><br> <span> <br> <iframe src="techabhi.wordpress.com" id=data style="width:100%;height:85%"></iframe> <script language=jscript> function navigate() { document.all.data.src=URL.value; } function clickshortcut() { if (window.event.keycode==13){ navigate() } } URL.onkeypress=clickshortcut; </script> </body> </html> Now save this code as name.hta and run it. You can see a small web browser has been made and it can even access you HDD when you type x:\ and press GO button. Now save this file as name.html and run it. You can still see the address bar and the GO button but you will not be able to surf the web nor access your HDD until you allow the scripts and active-X to run through your browser. This means that you can very well view the non-scripted part of the HTA on web browsers but not the scripted part. Conclusion: I request everyone, who have read this article, not to misuse the above provided code as I have tried to explain my point with these code and they are meant only for educational purpose. Hope you guys like it... __________________ Personal Log \| Star date 05.04.2009: TDF Meet Kanpur was Awesome www.TechFreakiez.com

09-01-2008, 02:29 PM	#2 (permalink)
anarkiLeo Right Off the Assembly Line Join Date: Nov 2007 Location: Pune Posts: 8	Re: The HTA applications Nice one Abhishek... thanks for sharing..keep it up.... can you recommend me some websites or some pdf docs on HTA technology.

09-01-2008, 05:08 PM	#3 (permalink)
Abhishek Dwivedi TechFreakiez.com Join Date: Sep 2006 Location: New Delhi Posts: 621	Re: The HTA applications thx for da sweet comment anarkiLeo...try googling for HTA applications...u'll find a lot of data...i personaly do not have any ebook on da topic... __________________ Personal Log \| Star date 05.04.2009: TDF Meet Kanpur was Awesome www.TechFreakiez.com

09-01-2008, 05:27 PM	#4 (permalink)
topgear Fast 'N' Furious Join Date: Jul 2006 Location: Geek's Heaven Posts: 9,119	Re: The HTA applications Thanks Abhishek Dwivedi __________________ ToPsPeEeD = FaSt BuT StEaDy AMD Radeon HD 6850 OverClocked to 1 Ghz !!! Blog : http://topgeartopspeed.wordpress.com/ ---------------------------------------------------- Never buy viewsonic products : http://tinyurl.com/ykwx4oa

14-01-2008, 01:32 PM	#5 (permalink)
vaibhavtek Guest Posts: n/a	Re: The HTA applications Thanks Abhishek Dwivedi

Popular Categories

Popular Articles

Content Categories

Sister Sites

Follow Us

Facebook Channels

Digit Magazine

	Advertisements. Register and be a member of the community to get rid of them.
Advertisement

22-01-2008, 03:43 PM	#6 (permalink)
Masroor Right Off the Assembly Line Join Date: Sep 2007 Posts: 32	Re: The HTA applications nice, but the browser is not runing fast.... why???

22-01-2008, 07:23 PM	#7 (permalink)
Abhishek Dwivedi TechFreakiez.com Join Date: Sep 2006 Location: New Delhi Posts: 621	Re: The HTA applications well...dat is not a fully loaded web browrer...its just a small HTA app so u can expect much frm it...its gud when u got nuthing...lolz __________________ Personal Log \| Star date 05.04.2009: TDF Meet Kanpur was Awesome www.TechFreakiez.com

03-02-2008, 09:55 AM	#8 (permalink)
Masroor Right Off the Assembly Line Join Date: Sep 2007 Posts: 32	Re: The HTA applications Nice!. but the browser is not working.

07-02-2008, 03:29 PM	#9 (permalink)
Abhishek Dwivedi TechFreakiez.com Join Date: Sep 2006 Location: New Delhi Posts: 621	Re: The HTA applications i can't understand u...chk da code...it shud wrk... __________________ Personal Log \| Star date 05.04.2009: TDF Meet Kanpur was Awesome www.TechFreakiez.com

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Applications for N80	tsaumya	Mobiles and Tablets	1	04-06-2006 03:10 AM
PHP for non-web applications	tuxfan	QnA (read only)	11	30-07-2005 12:16 PM
I cannot run applications	rajat22	QnA (read only)	3	01-07-2005 04:49 PM
dos applications in xp	runtime error	Software Q&A	2	26-04-2005 09:21 AM
DOS applications not working...pls help	runtime error	QnA (read only)	3	24-04-2005 02:18 AM