Hacker News Reader

He's traversing the site using the injected iframe. That is, there is no top-level navigation event, only an iframe navigation event. Then he's gathering information from the iframe hosted DOM and combining it in the context of the starting, main page.

I think it's kinda clever.

View on HN

Okay, I guess the scripts are supposed to run in the same origin, not from some third party, say airovic.com. I edited my original post.

It’s still more limited than puppeteer though.

Injecting an iframe into websites could trigger an assertion error, because the iframe isn't supposed to be there.

Hi, that's right. Some sites protect html injection. Twitter protects their site very well, but if you use http tunneling they can't do nothing as you can modify X- headers.

Interesting, could you explain what you mean by http tunneling and how it can bypass protection against html injection?

Reply on news.ycombinator.com