Magazine Internet

CodeSOD: JavaScript Obfuscation

Publié le 08 mars 2016 par Wtf

We have to be careful about the articles we publish on TDWTF. We have a responsibility to our submitters, to protect their identity and anonymize the details of their stories. We have a responsibility to our readers- mostly to be entertaining.

Last week’s JSF–k story failed one of our readers. Poor Blazej didn’t find it entertaining- it gave him upsetting flashbacks to his own experience with a similar event.

You see, Blazej was pitching in on a file uploading site, specifically meant to share videos. While he did some backend work, the front-end developers wanted to make sure that it was impossible to ever learn the actual URL of a video, to prevent people from downloading it. They wrote some JavaScript to obfuscate that URL, but that introduced a new problem: somebody could just read their JavaScript!

Using the same principles as JSF–k, but coupled with JavaScript’s unicode support, they produced this:

゚ω゚ノ= /`m´)ノ ~┻━┻   //*´∇`*/ ['_']; o=(゚ー゚)  =_=3; c=(゚Θ゚) =(゚ー゚)-(゚ー゚); (゚Д゚) =(゚Θ゚)= (o^_^o)/ (o^_^o);(゚Д゚)={゚Θ゚: '_' ,゚ω゚ノ : ((゚ω゚ノ==3) +'_') [゚Θ゚] ,゚ー゚ノ :(゚ω゚ノ+ '_')[o^_^o -(゚Θ゚)] ,゚Д゚ノ:((゚ー゚==3) +'_')[゚ー゚] }; (゚Д゚) [゚Θ゚] =((゚ω゚ノ==3) +'_') [c^_^o];(゚Д゚) ['c'] = ((゚Д゚)+'_') [ (゚ー゚)+(゚ー゚)-(゚Θ゚) ];(゚Д゚) ['o'] = ((゚Д゚)+'_') [゚Θ゚];(゚o゚)=(゚Д゚) ['c']+(゚Д゚) ['o']+(゚ω゚ノ +'_')[゚Θ゚]+ ((゚ω゚ノ==3) +'_') [゚ー゚] + ((゚Д゚) +'_') [(゚ー゚)+(゚ー゚)]+ ((゚ー゚==3) +'_') [゚Θ゚]+((゚ー゚==3) +'_') [(゚ー゚) - (゚Θ゚)]+(゚Д゚) ['c']+((゚Д゚)+'_') [(゚ー゚)+(゚ー゚)]+ (゚Д゚) ['o']+((゚ー゚==3) +'_') [゚Θ゚];(゚Д゚) ['_'] =(o^_^o) [゚o゚] [゚o゚];(゚ε゚)=((゚ー゚==3) +'_') [゚Θ゚]+ (゚Д゚) .゚Д゚ノ+((゚Д゚)+'_') [(゚ー゚) + (゚ー゚)]+((゚ー゚==3) +'_') [o^_^o -゚Θ゚]+((゚ー゚==3) +'_') [゚Θ゚]+ (゚ω゚ノ +'_') [゚Θ゚]; (゚ー゚)+=(゚Θ゚); (゚Д゚)[゚ε゚]='\\'; (゚Д゚).゚Θ゚ノ=(゚Д゚+ ゚ー゚)[o^_^o -(゚Θ゚)];(o゚ー゚o)=(゚ω゚ノ +'_')[c^_^o];(゚Д゚) [゚o゚]='\"';(゚Д゚) ['_'] ( (゚Д゚) ['_'] (゚ε゚+(゚Д゚)[゚o゚]+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~1)+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~1)+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~1)+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((c^_^o)+(c^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ (!+[]+!+[])+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (o^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((c^_^o)+(c^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (o^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (o^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~1)+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (o^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~1)+ (゚Д゚)[゚ε゚]+(+!+[])+ (!+[]+!+[])+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (!+[]+!+[])+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (+!+[])+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (-~-~1)+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (-~-~1)+ (゚Д゚)[゚o゚]) (゚Θ゚)) ('_');

My feelings on this? (⊙…⊙ )

CodeSOD: JavaScript Obfuscation
[Advertisement] Universal Package Manager - ProGet easily integrates with your favorite Continuous Integration and Build Tools, acting as the central hub to all your essential components. Learn more today!

Retour à La Une de Logo Paperblog

A propos de l’auteur


Wtf 169 partages Voir son profil
Voir son blog

l'auteur n'a pas encore renseigné son compte l'auteur n'a pas encore renseigné son compte

Magazine