We Keep Coding

replace/manipulate "hostname" in url without redirecting to it

Is there any way where I can replace the hostname in url but I do not want the browser to load/redirect/open the replaced hostname, it should just show it above in address bar nothing to do with it.
Scenario:
I am testing a website (legally) where I found that it is just checking the top.location.hostname in URL and if it is equal to self.location.hostname then it behaves normally else it throws the alert which is why I am guessing there could be a possibility of clickjacking if I can replace the hostname in address bar
If it can be done through JS then its awesome, i can load the my script of changing the name before the iframe domain hits it

Double-framing was one of the first attacks against frame-busting JavaScript. This is always very subjective to the exact code used, but you should check here if any attacks are relevant.
https://owasp.org/www-pdf-archive//OWASP_AppSec_Research_2010_Busting_Frame_Busting_by_Rydstedt.pdf
If this is a professional engagement, I would raise the issue regardless of whether or not you can produce a bypass of the frame-buster. X-Frame-Options is the strongest Clickjacking mitigation, and would never rely on JavaScript to do so.

Parse host from url without subdomains etc

I'm working on a chrome-extension that reads the domain from window.location.hostname. Now for this extension to work properly, I need to be able to separate subdomains and other url variation to the same host. example:
I need all of the following url:s
www.google.com
accounts.google.com
photos.google.se
example.google.co.uk
https://google.com
all of these need to be resolved to, in this case, "google", in a way that is reliable and will work for any website with sometimes quirky subdomainconfigurations.
this is my current aproach, somewhat simplified:
var url = window.location.hostname.split(".") //returns an array of strings
for(i=0;i<url.length;i++){
if(url[i].match(domainregex) //regex for identifying domains ".com",".se",".co.uk" etc
return url[i-1] //usually what I'm after is directly before the domain, thus i-1
}
This approach is alot of hassle, and has proven unreliable at times...Is there any more straitforward way of doing this?

A more reliable solution to strip the top level domain part and get the main domain part is to use Public Suffix List which is used by Firefox and Chrome and other browsers.
Several js parsers of the list data are available if you don't want to write your own.

I had to do it for my fork of edit-my-cookies, so It will able to change profile of cookies per site. (https://github.com/AminaG/swap-my-cookies-multisite/blob/master/js/tools.js)
It is what I did, and it is working for me. I am sure if it not complete solution, but I am sure it can helps.
var remove_sub_domain=function(v){
var is_co=v.match(/\.co\./)
v=v.split('.')
v=v.slice(is_co ? -3: -2)
v=v.join('.')
console.log(v)
return v
}
it is working for:
www.google.com
accounts.google.com
photos.google.se
example.google.co.uk
google.com
if you want it to work also for:
http://gooogle.com
You first need to remove the protocol:
parser=document.createElement('a');
parser.href=url;
host=parser.host;
newurl=remove_sub_domain(host);

how to configure settings in developer facebook?

I used plone 4.3 my site name is localhost:8080/alpster. I created sample page with facebook login.now when i click login button I got error like
Given URL is not allowed by the Application configuration.: One or more of the given URLs is not allowed by the App's settings. It must match the Website URL or Canvas URL, or the domain must be a subdomain of one of the App's domains.
my configure settings :
developer.facebook.com--->>>settings----> basic
namespace="alpster-login"
App Domains=alpster
Contact Email=my valid email
Site URL=localhost.com:8080
any one can solve my problem

Might not be able to use localhost, but I can't remember specifically.
If you are using localhost, you can't use .com in the appdomain. If doesnt let you do otherwise, then that means you must use an actual domain, not localhost. Use something like http://localtunnel.me/ to get around this.
Otherwise, just need to make sure the canvas & web urls match each other.

local storage see how much space each domain is using

After going through specification on HTML5 Storage: http://www.whatwg.org/specs/web-apps/current-work/multipage/webstorage.html#event-storage
In the paragraph 11.3 Disk space I have read that
User agents should allow users to see how much space each domain is
using.
But there is no information on how I can do this.
The only solution I came up with - is a hack like this:
JSON.stringify(localStorage).length
Is there a normal way to do it, because in my case you can see just one domain, not each domain.

An no one gave any response, I will be additing my own answer with whatever information I will find.
JSON.stringify(localStorage).length approximate number works for every browser
IE:
can be used through JS: window.localStorage.remainingSpace
Chrome:
through Settings>Content Settings>Cookies & Site data

Javascript security / cross scripting on same server

Have some Javascript that I need to work via the following:
://localhost
://servername
:/www.domainnamefortheserver.com
When I run the script from http://servername with an IFRAME referencing the domain - it does not load.
Is there a way to get the Javascript security model to recognize the server name, localhost and the domain as the same "domain"?
Thanks

If you are running on UNIX you can edit /etc/hosts to give a fake DNS entry for your server.
eg.
127.0.0.1 localhost www.domainnamefortheserver.com
Then you can always connect to it as the correct name even when it's not on the live site yet. Don't try and break the javascript security directly.
This will also work on OSX. Windows works differently, I expect.

If you are using a server-side language to generate the page, you may be able to set the security domain like so:
document.domain = $CURRENT_HOSTNAME;
So the security domain will be the domain the user requested. This is a shot in the dark, but I hope it helps nonetheless.

Use root relative URIs:
href="/foo/bar"
rather than absolute URIs:
href="http://example.com/foo/bar"
That way the document will be loaded from the same hostname.

What do you mean by
my references are to the domain name
?
If you load scripts in your page on http://servername (using <script src=''>), they will have access to everything on http://servername, even if they come from another domain.
However, if you try to make AJAX calls to the other domain, then you have a problem. You can use the trick explained by Christopher, ie making aliases to the domain.