How to bring down Internet Explorer with six words

7 August 2007

Thanks to Kelly Yancey, who found a Japanese Blog that discussed an interesting bit of HTML, it reminds me of the Doctor Who special called 'The Christmas Invasion', where the Prime Minister destroys the retreating Sycorax spaceship, much to the Doctor's annoyance.

The Doctor: Don't challenge me, Harriet Jones. 'Cause I'm a completely new man. I could bring down your Government with a single word.

Harriet Jones: You're the most remarkable man I've ever met. But I don't think you're quite capable of that.

The Doctor: No, you're right. Not a single word.

[pause]

The Doctor: Just six.

Harriet Jones: I don't think so.

The Doctor: Six words.

Harriet Jones: Stop it!

The Doctor: Six.

[approaches Alex, whispering in his ear]

The Doctor: Don't you think she looks tired?

How to bring down IE with six words...

... or more specifically five HTML tags and a CSS declaration:

<styl>*{position:relative}</style><table><input /></table>

In short, it sends Internet Explorer down in flames. IE is not known for great CSS support at the best of times, I suppose here that some piece of badly written code within IE did not expect the wildcard and so IE is going round in an infinite loop, causing a memory error or buffer overrun or one of these other horrible things that languages without inbuilt memory management are susceptible to.

Kelly reported that it was only IE6, however, I tested in IE7 and had a similar effect.

Start by opening this link. You get a webpage like this:

Step 1, we can have lots of fun.

Perhaps we are not worried yet, so far so good. However, now try to go somewhere else, say in a new tab:

Step 2 - there's so much we can do

Houston we have a problem.

1 gabe says...

ie does not crash with that link at all on vista but crashes on xp

Posted at 7:56 p.m. on August 7, 2007


2 Zeth says...

Thanks for that gabe. That is an interesting distinction. Are you opening the new tab? I wonder how Windows 2000 and 98 react. There are a lot of users still using those operating systems that do not get much in the way of updates.

I personally do not use Windows at all personally, besides testing websites when I use XP. I am currently avoiding Vista at the moment, although I'm sure I will need to have a test virtual machine one day (I make websites in my day job).

Posted at 8 p.m. on August 7, 2007


3 Phill says...

Oh, Internet Explorer is a joke. I found out the other day at work another little problem... a piece of JavaScript worked perfectly in Firefox, but not in IE. It turns out that IE has problems with dynamic radio buttons. Utter crap, for the most-used browser in the world. What annoys me is that these bugs are in IE7, not IE6. And, as far as I know, there is no website where bugs can be sent through. Bloody Microsoft, eh?

Posted at 9:45 p.m. on August 7, 2007


4 Phill says...

Note: What I meant by "in IE7, not IE6" above was not that the bugs weren't in IE6 at all (I don't know, they might have been), but just that they're in the latest version of the browser, one which is supposed to be standards compliant etc...

Posted at 9:46 p.m. on August 7, 2007


5 Jon says...

working web developer i have come to truly despise IE sometimes. I never had to much of a problem with it until i started working on sites that need to support down to IE5!!!

I've come across some really annoying IE bugs but luckily i spend 90% of my time working on the back-end (python FTW!) but that 10% i have to deal with the front end i hate because of IE.

Sorry for the little rant there. Anyway i don't hate IE completely just annoys me a lot.

When i read this earlier it just made me laugh and remember a bug i came across not to long ago. IE6 crashing when "window.onresize" is set and something is moved or resized using Javascript??!! that had me confused for a while

Posted at 11:23 p.m. on August 7, 2007


6 FiRe says...

Doesn't crash on XP x64

Posted at 11:28 a.m. on August 8, 2007


7 Zeth says...

How to bring down a server in six words?

Make it onto Slashdot!

http://it.slashdot.org/article.pl?sid=07/08/08/0212223

Funnily enough the server is still responsive in other ways, so the problem is with how Apache is configured. Or maybe having 3000 users within the first 10 minutes is always just a bit tough.

Posted at 11:33 a.m. on August 8, 2007


8 Lixas says...

does not crash on last xp 15 (XP pro processor IE 7) 32bit celeron mobile

Posted at 11:42 a.m. on August 8, 2007


9 Peter Flynn says...

It blows a freshly-installed IE6 out of X the moment it loads the page, using Crossover Wine under Ubuntu Edgy.

BTW your actual file differs from the one you quote. It actually reads:

*{position:relative}
(omitting the comment).

Posted at 12:10 p.m. on August 8, 2007


10 Paul Bowman says...

IE 7 crashes on Win XP 64bit!

Posted at 12:14 p.m. on August 8, 2007


11 Adam C says...

wowzerz! IE disappeared on XP SP2 x86 w/IE6. No crash message.

What would happen if this were embedded in a page with other harmless content?

Posted at 12:16 p.m. on August 8, 2007


12 Pepe says...

Wow, nice way to punish ie users, hehehee.

Posted at 12:24 p.m. on August 8, 2007


13 Peter Flynn says...

Adam C writes: > What would happen if this were embedded > in a page with other harmless content?

Why, then your page would be invalid HTML, and you wouldn't want that, would you? :-)

Posted at 12:32 p.m. on August 8, 2007


14 AxsDeny says...

It kills IE 5.0 on a fresh Win98 installation.

Posted at 12:46 p.m. on August 8, 2007


15 Cillian says...

Crashes IE 5.0 on Windows 2000 SP2... Go to the page, and straight away it crashes - no need to navigate to another page.

Posted at 12:47 p.m. on August 8, 2007


16 David Robinson says...

IE7 (7.0.6000.16473) in Vista Business (Intel Core2) crashes with the crash page open, when you open a new tab.

Not immediately, it takes a few seconds. Interesting find... :)

Posted at 12:55 p.m. on August 8, 2007


17 Ben says...

I put this on my myspace, because I hate it. It works crashing IE on my XP SP2 32-bit.

I opened the page in windows explorer - because silly microsoft allows that, and it crashed the desktop! woot!! i am loving this!

Posted at 1:03 p.m. on August 8, 2007


18 C says...

Crashes IE 6.0 on WIN 2000 on page load - no need to navigate to another page!

Very nice. I'll have to put this with the IE-detecting conditional comments and other bug-inducing code on my proof-of-concept website.

Posted at 1:21 p.m. on August 8, 2007


19 Georgi D. Sotirov says...

No crash on IE 7 (7.0.5730.11) on Windows XP Version 2002 SP 2.

Posted at 1:28 p.m. on August 8, 2007


20 Jivlain says...

If you have it stored on a XP machine, it will crash Windows explorer when you select it. No need to even open Internet Explorer!

Posted at 1:45 p.m. on August 8, 2007


21 Mikkel says...

Crashes IE7 on my windows XP laptop. Not right away, but after a few secs

Posted at 1:48 p.m. on August 8, 2007


22 Aaron says...

On my locked down work machine with XP and IE6, it just simply blows up when it tries to load that page. Doesn't even give me the "An error occured", or even loads up the page. It simply dies without saying a word.

Posted at 1:49 p.m. on August 8, 2007


23 Yoni says...

On ubuntu, under wine (with ies4linux), it crashes ie6 but not ie7.

Posted at 2:04 p.m. on August 8, 2007


24 Anon says...

Firefox 3 will freeze from an object element with a present but empty data attribute.

[object data=""] or even just [object data

Where [] are angle brackets.

Posted at 2:09 p.m. on August 8, 2007


25 Timothy says...

My IE crashes when attempting to play Windows Media Player streams. Grow the fcuk up. Do something important with your time. This is ridiculous

Posted at 2:11 p.m. on August 8, 2007


26 SillyUser says...

No problems for me.

Page loads, other pages load, life continues with no problems at all for my MSIE 7.

7.0.5730.11 on XP Pro SP2, fully patched.

Posted at 2:16 p.m. on August 8, 2007


27 tony says...

Hey I showed this to my friends and they said this is not a trick IE does this all the time :-)

Posted at 2:23 p.m. on August 8, 2007


28 SillyUser says...

Strike that comment!

Didn't realize it took 2-3 minutes to crash. Yet another reason to stick to Firefox....

Posted at 2:29 p.m. on August 8, 2007


29 ehrichweiss says...

Since no one else thought of it yet, IETab in Firefox will crash on that page, no need to navigate elsewhere.

This is on XP Pro SP2, Firefox 2.0.0.6(I think).

Posted at 2:34 p.m. on August 8, 2007


30 Conrad says...

At first, I though it would not crash, but I had not read the entire article: To see the crash you must open a new tab. I suspect most of the people who claim that IE 7 does not crash are not navigating anywhere.

Posted at 2:38 p.m. on August 8, 2007


31 noname says...

crashes rather nicely on my IE7 using Vista Home Premium (32bit)

Posted at 2:40 p.m. on August 8, 2007


32 rasmus says...

all we need now is a viscious script to make that page the startup page in IE...

finally the internet will be free!!

Posted at 2:49 p.m. on August 8, 2007


33 Cory says...

This is great. I've put this on my myspace page. Nobody with IE gets to see me now!

Posted at 3:04 p.m. on August 8, 2007


34 Rionn Fears Malechem says...

To keep IE users from viewing your page, all you need is an empty title tag. You can fill it in with script if you want a title. your content here

Posted at 3:24 p.m. on August 8, 2007


35 Manoj says...

My Windows explorer crashes too!! I created test.html file with those nasty 5 tags! when I click ( NOT double click) on the file, my Windows explorer crashed. So I was unable to open that file using IE.

Then I opened IE 6 and used File->Open->Browse to this test.html and You know what would have happened!

I was unable to delete that file, just by selecting and delete!!

Posted at 3:45 p.m. on August 8, 2007


36 rigbydt says...

Crashes IE7+ on Windows Vista Ultimate Edition a few seconds after opening a new tab. I get the "Internet Explorer has stopped working" dialog box.

Posted at 3:54 p.m. on August 8, 2007


37 James Darling says...

You are my hero. Destroying IE, whilst quoting Dr. Who? Awesomeness on a stick.

Posted at 4:19 p.m. on August 8, 2007


38 Cloudscout says...

So an asterisk causes it to crash? Maybe this should be called the "Barry Bonds Bug".

Posted at 4:31 p.m. on August 8, 2007


39 Roelant says...

I have no problems at all, my browser has no trouble rendering the page, even after a while.

Guess my Mac is defective.... :-)

Posted at 4:41 p.m. on August 8, 2007


40 narc says...

I got my 6.0 on XP SP2 to crash direcly on load. I couldn't even see the input border. Crash, crash, crash :)

Posted at 5:10 p.m. on August 8, 2007


41 kyle says...

crashed on load on my computer. ie v6 and windows media center

Posted at 5:32 p.m. on August 8, 2007


42 Doogie Mungster, MD says...

What amuses me are all the techies who go from bitching about old IE to talking about how they have to support it in their websites all in one breath... grow spines, or at least balls. If shitty websites stopped working in IE 5, people would have to upgrade. It's your own damn faults people still use it. Cliched though this may be, you're just like all those German citizens who became Nazis, because they lacked the self-confidence to say "no".

Posted at 6:17 p.m. on August 8, 2007


43 eric says...

Crashes my IE 7 on XP sp2 fully patched. Only when opening a new tab though

Posted at 6:27 p.m. on August 8, 2007


44 alert('uh oh')test says...

alert('uh oh')test

Posted at 6:29 p.m. on August 8, 2007


45 iball says...

IE sux. FF pwnz

Posted at 6:31 p.m. on August 8, 2007


46 More fun with IE and CSS » LonelyMachines says...

Hamachiya discovered this a few days ago, and it's repeated here.

Posted at 6:43 p.m. on August 8, 2007


47 Wing says...

Extremely cool bug. Tested it on my Windows system:

  1. Copy-n-paste url into the IE address field to load, will crash IE on load.
  2. Emailing the HTML file/document to myself via Outlook did not crash outlook. guess it's not using IE for the rendering?
  3. Saving the code to an html file will result in a IE/iexplorer crash, upon opening the file via double-click. Select, then right click to delete did not cause a crash. Perhaps because I don't have previewing/etc stuff turned on.
  4. would be interesting to see how this behaves if your activex desktop is setup to load this as one of the html/doc files to show on the desktop?

Posted at 7:44 p.m. on August 8, 2007


48 sholsinger says...

Screencap:

http://commandline.org.uk/images/posts/windows/hamachiya_ie_nocrash_ie7.gif

XP Pro (5.1.2600) x86 32bit IE7.0.5730.11 Update versions:0 - Doesn't crash, but will not re-render the tab. Mem usage stays within acceptable range: 21Mb - 32Mb.

Posted at 7:51 p.m. on August 8, 2007


49 Noxious bob says...

XP x86 causes Internet Exploder to crash and burn. No effect on IE7. W2K SP4 and IE 5.01.. no messages in fact it takes out Windows Explorer too.

Posted at 8:17 p.m. on August 8, 2007


50 Ray says...

Um... how does one find this out? There is no reason you would ever write that...

Posted at 8:34 p.m. on August 8, 2007


51 Dimiter says...

It crashes on Vista x64, both IE7 x86 and IE7 x64. For those of you who say it doesn't crash: try opening a new tab by clicking the 'new tab' minitab. It crashes nicely.

Posted at 5:24 a.m. on August 9, 2007


52 www.ilan.eu.org says...

Ubuntu 7.04 with wine and IE6

IE6 crashes

Posted at 5:38 a.m. on August 9, 2007


53 Tadeusz Szewczyk says...

Here I collected all 7 still working ways of crashing IE, at least in version 6: http://seo2.0.onreact.com/top-7-ways-to-crash-internet-explorer

Posted at 2:17 p.m. on August 9, 2007


54 OffBeatMammal says...

The problem is with the malformed tag and it's been around for quite a while

http://www.securityfocus.com/archive/1/319360/2003-04-20/2003-04-26/0

Posted at 6:05 p.m. on August 9, 2007


55 How to Kill IE7 in Windows Vista | PCTips Box says...

more nothing less. Is this all it takes to kill IE7? Well yes, just follow this link, courtesy of Commandline, and if the browser doesn’t crash immediately try opening a new

Posted at 12:21 p.m. on August 10, 2007


56 Vimk says...

Neat little exploit, but what would the html be to hide the box that results from it? Wouldn't do for non IE viewers to see a random input table...

Posted at 3:59 a.m. on August 12, 2007


57 Mike says...

I tried this on IE7 on Vista, when I opened a new tab and started typing a url it crashed. I don't know why it didn't work for Gabe but it certainly worked for me.

Posted at 9:14 a.m. on August 12, 2007


58 Eric says...

well, let's combine that with the Win98 + IE 4/5 bug that crashes the machine.

Posted at 11:47 a.m. on August 12, 2007


59 Justin Turner says...

Crashes IE6 running on WINE in Ubuntu Linux.

CRASH AND BURN INTERNET EXPLORER!

Posted at 5:26 a.m. on August 14, 2007


60 jaxsun says...

it doesnt crash ietab for firefox, HUZZAh

Posted at 8:04 a.m. on August 15, 2007


61 Thomas Wrobel says...

Opera handels it fine, of course. Seeing as they got important people that invented CSS on their team, its hardly supprising.

Posted at 11:16 a.m. on August 17, 2007


62 Adam Tuttle says...

It didn't crash internet explorer, but my Avast anti-virus detected it as a VBS virus. So it never had a chance to crash. Weird.

Posted at 10:48 p.m. on August 20, 2007


63 bobp says...

Tried to load in IE7 and Firefox on Vista:( with Avast! virus protection. It catches it as a VBS:Malware with the message:

VBS:Malware [Gen]" has been found in "http://hamachiya.com/junk/ie_crash.html

Posted at 6:21 p.m. on August 22, 2007


64 Caverna says...

Maxthon 1.5.9 crash too!!! :D

Posted at 11:53 a.m. on August 23, 2007


65 horsedrowner says...

it also crashes microsoft visual studio (2003) :P

Posted at 1:57 p.m. on August 23, 2007


66 Duckiputz says...

Well, it kills 7.0.5730.11 right away... on Win2k3 Server WTS.

Urgh!

Posted at 8:21 p.m. on August 29, 2007


67 Danny says...

Didn't do anything in IE7 XP edition.

Posted at 2:36 a.m. on September 3, 2007


68 fak3r says...

Fun stuff, kills IE6 in XP (at work) and IETab within Firefox! Plus, I think I found a new link for my sig files:

http://commandline.org.uk/more/microsoft/how-to-bring-down-internet-explorer-with-six-words-2007-08-07-19-18.html?showcomments=yes%3Cstyle%3E*{position:relative}%3C/style%3E%3Ctable%3E%3Cinput%20/%3E%3C/table%3E

Click on that link in IE, crash! Yea!

Posted at 9:17 p.m. on October 19, 2007


69 Rick B says...

I tested the code in Windows XP Pro SP2 under VMware. FireFox opened it fine, IE 6 crashes as expected. The surprising thing is IE 5.2 for Mac. Which was discontinued years back, opened the file fine just like FF.

Posted at 11:39 a.m. on April 4, 2008


70 Mark Szeman says...

Im having problems with a brand spanking new instalation of xp 64 , any program i open crashes as soon as i start typing , if i write what i want in notepad and copy it in it works , Im currently typing this on my MBP and i wish i had spent my cold hard cash on a mac pro now instead of a pc but does anyone have any idea what this could be , no viruses on my computer or any adware spyware etc etc .. im clean but the darn thing still keeps crashing ..thanks Bill.. Keep it up Mr. Jobs .

Posted at 10:55 a.m. on May 1, 2008


71 Jim Smith says...

I didn't know that anyone with enough savvy to do this was still using IE. Almost everyone I know here in Brazil is using something different and even most of my friends in the USA are using Firefox, Safari, or Opera. Naturally, they will always be those so ignorant and helpless that they will accept any piece of garbage Micro$oft hands out. But I am surprised readers here would do it.

Posted at 7:53 p.m. on September 8, 2009


72 A Nanny Moose says...

dude, my anti-virus picks the website as a malware carrier LOL

Posted at 12:59 a.m. on September 17, 2009


73 rchard2scout says...

my antivirus (Avast) blocks it as malware XD

Posted at 7:02 p.m. on September 18, 2009


74 Brian R. Hickey says...

Symantec picked it up too.

Posted at 4:08 p.m. on November 20, 2009


What do you have to say?

Show Editing Help

About

Hello, my name is Zeth, I'll be your host here.

Command Line Warriors is about taking control of your own technology, it looks at our experiences of computing; especially using GNU/Linux, the Python programming language, the command-line and issues such as techno-ethics, best practices and whatever is cool now. If you take control of your technology then you are a Warrior too!

This site is your site too which means that you can contribute and get involved. You can leave comments using the facility provided. For me, the comments and discussions are by far the best part of the site. So please do have your say!

Latest Discussions

Zeth

November 29, 2009
Hi Jordan, yes that URL is gone now. I have a new contact form on this site.
Python CGI contact forms

Jordan

November 29, 2009
Zeth attention! Your form, http://zeth.me.uk/contact/, is not working The explorer says connecting ..but nothing happens Sorry for my poor English: I am Spanish Regards
Python CGI contact forms

Jordan

November 26, 2009
Sorry: tell me , not tellme (I'm spaniard) And http://zeth.me.uk/contact/ don't work
You got the touch, you got the power

David Jones

November 25, 2009
Your mad skillz are too l33t! for me. I specifically switched to Google Reader so that I could show people what blogs I read. But I couldn't work out how ...
How to find the fashionable blogs quickly

Brian R. Hickey

November 20, 2009
Symantec picked it up too.
How to bring down Internet Explorer with six words

Zeth

November 17, 2009
Thanks djm, I am the moose here. Christian, assuming one actually does Internationalise the countries, it should still work I guess, as the gettext stuff will happen before the list ...
Countries in Django

Phillip Temple

November 17, 2009
Good start, but: a) wouldn't I want None back rather than 'ZZ'? b) why not add a 'shortcut' boolean, then prepend flagged fields (plus usual '-----' separator) to the actual ...
Countries in Django

djm

November 17, 2009
Am I being a moose or did you mean: from whatever.countries import CountryField instead of from whatever.countries import CharField ? Good post though, cheers.
Countries in Django

Christian Joergensen

November 17, 2009
Wouldn't the ordering get messed up after i18n?
Countries in Django

Steve - Electronic Cigarettes Fan

November 17, 2009
Very well done. Is your blog just you writing? Nicely done, Steven.
Blogger vs Wordpress

vetetix

November 15, 2009
Sorry to bother you nearly two years after you wrote this blog article, but I can't manage to find how to modify an existing field. I am trying to change ...
Three Useful Python Bindings - ClamAV, Apt and Evolution

Manju

November 4, 2009
I am transferring some files using psftp to other device's FAT partition. But the filestamp of the file being transferred is modified to that of FAT device, after the transfer. ...
PuTTY Series: Using PSFTP

iki

November 2, 2009
or simpler: socket.gethostbyname_ex(socket.gethostname())[2]
How to find out your IP address in Python

iki

November 2, 2009
local_ip = set([ i[4][0] for i in socket.getaddrinfo(socket.gethostname(), None) if i[0] == 2 ])
How to find out your IP address in Python

Fred

November 2, 2009
testing rst ------------- - point 1
An Introduction to ReStructuredText

Ano

October 27, 2009
"You simply found the license of the StumbleUpon Toolbar for Internet Explorer." That's possible. I've got some more interesting information to add. Firstly, go to this page: https://addons.mozilla.org/en-US/firefox/addon/138 - this ...
Are your Firefox extensions proprietary software?

Ken

October 21, 2009
Stumbled in here at lunch. This is the best find of the week. Thanks.
Three classic command line tips

Jim

October 19, 2009
Thanks for the rtsp:// post - that's something that has been bugging me for a while!
Three classic command line tips

Zeth

October 18, 2009
Thanks for the comments guys. Great to see the all the gang are still here!
Three classic command line tips

Bubba

October 18, 2009
Is there any way psftp can return the true transfer rates oberved during the actual transfer?
PuTTY Series: Using PSFTP