JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )
adamcecc.blogspot.com
adamcecc.blogspot.com
And the forum thread where this technique was explored at length: http://sla.ckers.org/forum/read.php?24,33349,33405
Superfun. :D
And "aaencode" Encode any JavaScript program to emoticons: http://utf-8.jp/public/aaencode.html
Here it is: https://www.defcon.org/html/links/dc-archives/dc-16-archive....
https://www.defcon.org/images/defcon-16/dc16-presentations/d...
The whole trick stems from the fact that !$ == false and !$+$ == "false"
![] == false because [] exists.
false + [] == 'false' because anything added to an array will become whatever that is as a string plus the contents inside the array.
2 + [] is also a string "2"
2 + [2,2] will become "22,2" (string)
What I don't get though, wouldn't you still need to call eval() on it to do anything with it? Or does javascript do a 'implied eval' when you try to call a string?
Problem is, there are a lot of ways to say document.cookie, and a blacklist is going to miss one of them.
Moral of the story: if people can execute scripts on your page, you're 0wned. Everyone competent knows this, but sometimes the less competent are slow to realize this.
So, the script that the article describes is for their benefit. Good luck writing a regex to stop this one...
(There are also even simpler "exploits", if you regex document.cookie to the empty string, then "document.document.cookiecookie" regexes to "document.cookie". Ooops.)
Could you give an example?
alert(document.cookie)
([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]])(([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[([][[]]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+[]]+((+[])[([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]])[([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+[][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+[+[]])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]])
[1] http://news.ycombinator.com/item?id=2129815[1] Or rather, safer. There are always obscure ways to get around almost everything. So you really have to take care to exactly the situation you're in at the moment.
any answer other than "Zero" or "wtf-look", do not hire.
What if you're hiring someone to test for XSS exploits?
inner $=[] will be overwritten by outer $=[$], which is the same as $=[[]]
or am i missing something?
the code unobfuscated is: (a=[a=[]]['sort'])()['alert'](1)
my argument is that this is the same, and less chars (a=[]['sort'])()['alert'](1)
I can't see any benefit of the encapsulation of the array assignment there.
edit: also, just noticed that my previous comments i was writting $=[[]] when i was thinking of $=[], but both works the same, and are still less chars :)
on the last string trick to write 'sort' it fails if there's no $=[$=[]]
all the other parts just $=[] works just fine. and they are in the same scope as the 't' i can't understand
(lines are numbered in order of execution, with explanations of each line)
($=[ // 14: $ = Array.prototype.sort ([]["sort"] = Array.prototype.sort)
$=[] // 1: $ = []
][
(__= !$+$ )[ // 2: __= "false" (![]+[] = false+[] = "false")
_=-~-~-~$ // 3: _= 3 (-~-~-~[] = -~-~-(-1) = -~-~(1) = -~-(-2) = -~(2) = -(-3) = 3)
]+ // 4: "s" ("false[3]" = "s")
({}+$)[ // 5: "[object Object]" ({}+[] = "[object Object]")
_/_ // 6: 1 (3/3 = 1)
]+ // 7: "o" ("[object Object]"[1] = "o")
($$= // 12: $$ = "rt"
($_= // 9: $_ = "true"
!''+$ // 8: "true" (!''+[] = true+[] = "true")
)[_/_]+ // 10: "r" ("true"[3/3] = "true"[1] = "r")
$_[+$] // 11: "t" ("true"[+[]] = "true"[0] = "t")
) // 13: "rt"
])()[ // 15: window (sort() = window)
__[_/_]+ // 16: "a" ("false"[3/3] = "false[1]" = "a")
__[_+~$]+ // 17: "l" ("false"[3+(~$)] = "false"[3+(-1)] = "false"[2] = "l")
$_[_]+ // 18: "e" ("true"[3] = "e")
$$ // 19: "rt"
](_/_) // 20: alert(1) (window["alert"](3/3) = alert(1))
If you wanted to remove the a=[] you'd have to include a bunch of "[]"s inline, e.x.:
($=[][
(__= ![]+[] )[
_=-~-~-~[]
]+
({}+[])[
_/_
]+
($$=
($_=
!''+[]
)[_/_]+
$_[+[]]
)
])()[
__[_/_]+
__[_+~$]+
$_[_]+
$$
](_/_)
(F=[
A=[]
][
(B= !A+A )[
C=-~-~-~A
]+
({}+A)[
C/C
]+
(D=
(E=
!''+A
)[C/C]+
E[+A]
)
])()[
B[C/C]+
B[C+~F]+
E[C]+
D
](C/C)
I'm not sure I can make it any clearer.
but i'm still not convinced of the steps :)
($=[][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+ ($$=($_=!''+$)[_/_]+$_[+[]])])()[__[_/_]+__ [_+~$]+$_[_]+$$](_/_)
here i kept $, only step 11 required [] instead of $
i'm guessing step 14 is actually executed earlier... or that undefined has the same effects as [] for most of those stringfying hacks. Update: no, undefined trhows an error. so step 14 is earlier... let me replace all that with a eval function that also stores the run order. then i will post the correct ordering.
If you still refuse to believe me, I give up.