The 6on6 folder was a small personal tool — an HTML page backed by an #default#homePage behavior and userData persistence — that I used to track and quickly test browser security issues. The interface let you load arbitrary ActiveX objects by CLSID or ProgID, run JavaScript snippets against them with a double-click evaluator, and enumerate their properties.

<!-- index.html: the 6on6 research tool -->
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>myBase Tester</title>
</head>
<body style="behavior:url(#default#homePage);">
<style type="text/css">
input, textarea, select, span	{
	font-family: Tahoma, Arial, Helvetica, sans-serif;
	font-size: 12px;
}
.busy	{ background-Color: #DD7070; }
.ready	{ background-Color: #70DD70; }
.error	{ background-Color: #FF3030; }
.reset	{ background-Color: #FFFFFF; }
</style>

	<input id="theValue" tabindex="1" style="width:250px;" onkeypress="if(event.keyCode == 13) loadObject(document.all.theValue.value)">
	<input type="button" style="width:80px;" value="Load Object" onclick="loadObject(document.all.theValue.value)">
	<input id="in2" class="ready" style="width:80px;">
	&nbsp;&nbsp;&nbsp;
	<br />
	<textarea tabindex="2" id="codeEvaluator" ondblclick="document.all.in2.className='busy';eval(document.all.codeEvaluator.value);setTimeout('document.all.in2.className = \'ready\';',100);" onkeypress="if ((event.keyCode == 13 || event.keyCode == 10 )&& event.ctrlKey){document.all.in2.className='busy';if (event.shiftKey) setTimeout(document.all.codeEvaluator.value,'1');else eval(document.all.codeEvaluator.value);setTimeout('document.all.in2.className = \'ready\';',100);}" style="width:450px;height:120px;"></textarea>
	<br />
	<iframe style="behavior:url(behavior.htc);width:457px;height:200px;" name="ifr" id="ifrID" src="http://www.iframe.com/"></iframe>
	<br />
	<div id="objectContainer" style="float:left;width:200px;height:160px;font-family:Tahoma,Arial;font-size:12px;border:ridge;">
		<script language="JavaScript">
			document.write('&nbsp;Location: ' + document.location + '<br />&nbsp;Domain: ' + document.domain + '<br />&nbsp;Length: ' + window.length);
		</script>
	</div>
	<div style="float:left;width:300px;height:200px;">
	<select onchange="codeGenerator(this.value)">
	<option value="0">------&gt; Generate Code &lt;------</option>
	<option value="1">createPopup</option>
	<option value="2">insertAdjacentHTML</option>
	<option value="10">oXML responseText</option>
	<option value="11">oXML XSL Script</option>
	<option value="3">window.open()</option>
	<option value="5">object Tag</option>
	<option value="6">htmlFile object Tag</option>
	<option value="7">iframe Tag</option>
	<option value="8">ifr magicmac.com</option>
	<option value="9">ifr iframe.com</option>

	</select>
	<textarea tabindex="3" id="enumProps" style="width:242px;height:142px;" ondblclick="if (event.shiftKey) enumProperties();else enumForInProperties()">Enum Properties: No Objects</textarea>
	</div>
	<br />

	<iframe name="ifr2" id="ifr2ID" width="100" height="100" style="display:none;"></iframe>
	<iframe name="ifr3" id="ifr3ID" width="100" height="100" style="display:none;"></iframe>


<script language="JavaScript">
var obj1, obj2, lastLoaded;
function codeGenerator(codeNumber)
{
	var enumProps = document.all.enumProps;
	switch (codeNumber)
	{
		case "1":
			enumProps.value = 'myPop = createPopup();\nmyPop.document.body.innerHTML=\'\';';
			break;

		case "2":
			enumProps.value = 'document.body.insertAdjacentHTML(\'beforeEnd\',\'\');';
			break;

		case "3":
			enumProps.value = 'window.open("","");';
			break;

		case "5":
			enumProps.value = '<object id="newObj" data="nofile.html" type="text/html" width="400" height="200"></object>';
			break;

		case "6":
			enumProps.value = '<object id="htmlObj" classid="clsid:25336920-03F9-11CF-8FD0-00AA00686F13" data="nofile.html" width="400" height="200"></object>';
			break;

		case "7":
			enumProps.value = '<iframe name="newIframe" src="" width="100" height="100"></iframe>';
			break;

		case "8":
			ifr.location.replace('http://www.magicmac.com');
			break;

		case "9":
			ifr.location.replace('http://www.iframe.com');
			break;

		case "10":
			enumProps.value = 'window.sChange = function()\n{\n	if (oXML.readyState==4)\n	{\n		alert(oXML.responseText);\n	}\n}\noXML = new ActiveXObject("Microsoft.XMLHTTP")\noXML.onreadystatechange = sChange;\noXML.open("GET", "index.html", true);\noXML.send(null);';
		break;

		case "11":
			enumProps.value = 'oXML = new Object();\noXML.xml = new ActiveXObject("MSXML2.DOMDocument.3.0");\noXML.xml.loadXML("<xmltag>xmlText</xmltag>");\n\noXML.xsl = new ActiveXObject("MSXML2.DOMDocument.3.0");\noXML.xsl.async = false;\noXML.xsl.load("mimeTypes/xsl.xsl");\n\noXML.xml.transformNode(oXML.xsl);';
		break;

	}
	enumProps.select();
}

function enumProperties()
{
	var str = '', iObj;
	for (var i = new Enumerator (lastLoaded == 1 ? obj1 : obj2); !i.atEnd(); i.moveNext()){
		iObj = i.item();
		str+= (iObj.nodeName ? iObj.nodeName : iObj.tagName ? iObj.tagName : 'Unknown') + ' = ' + iObj + '\n';
	}
	if (str.length > 1)
	{
		document.all.enumProps.value = str;
	}
	else {
		document.all.enumProps.value = (lastLoaded == 1 ? "obj1" : "obj2") + " has no properties.";
	}
}

function enumForInProperties(){
	var count = 0;
	var str = '';
	for (var i in (lastLoaded == 1 ? obj1 : obj2)){
		if (++count>400) break;
		try{
			str+=i+' = '+(lastLoaded == 1 ? obj1 : obj2)[i]+'\n';
		}
		catch(e){}
	}
	if (str.length > 1)
	{
		document.all.enumProps.value = str;
	}
	else {
		document.all.enumProps.value = (lastLoaded == 1 ? "obj1" : "obj2") + " has no properties.";
	}
}
function loadObject(obj)
{
	if (obj.indexOf("-")!=-1)	// It's a CLSID
	{
		clsID(obj);
	}
	else
	{
		progId(obj);
	}
}
function clsID(clsIDValue){
	document.all.objectContainer.innerHTML='<OBJECT ID="clsObj" CLASSID="clsid:'+clsIDValue+'" WIDTH="390" HEIGHT="190"></OBJECT>';
	document.all.enumProps.value='Enum Properties: obj1';
	lastLoaded = 1;
	obj1 = document.all.clsObj;

	// Just in case the object delays a little loading, we place it again.
	setTimeout('obj1 = document.all.clsObj;',2000);
}
function progId(objCLS)
{
	document.all.in2.value="Trying...";
	try
	{
		obj2=new ActiveXObject(objCLS);
		document.all.in2.value="obj2 Ready";
		lastLoaded = 2;
		document.all.enumProps.value='Enum Properties: obj2';
	}
	catch(e){
		document.all.enumProps.value='Enum Properties: No Objects';
		obj2=false;
		document.all.in2.value="FALSE";
	}
}
window.onerror=function(desc, url, line)
{
	document.all.enumProps.value = 'Description: ' + desc + '\n\nLine: ' + line + '\n\nUrl: ' + url;
	document.all.enumProps.className = 'error';
	setTimeout("document.all.in2.className = 'ready';document.all.enumProps.className = 'reset';",500);
	return true;
}
</script>
</body>
</html>

This was a personal scratchpad for browser security research. Type a CLSID (with hyphens) or a ProgID (like WScript.Shell) into the input and click “Load Object” — it instantiates the object and you can then enumerate its properties or write arbitrary JavaScript against it in the textarea. Double-clicking the textarea evaluates its contents; Ctrl+Enter does the same from the keyboard. The #default#homePage behavior and userData persistence meant the tool remembered its state between sessions, which was useful when testing many different CLSIDs across multiple days.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.