JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )

http://adamcecc.blogspot.com/2011/01/javascript.html

by there • 16 years ago

403 46 16 years ago

$Preview of JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )$ adamcecc.blogspot.com

nicksergeant• 16 years ago

Well, that was interesting.

loganlinn• 16 years ago

Great use of JavaScript's weird + operator.

The whole trick stems from the fact that !$ == false and !$+$ == "false"

weixiyen2• 16 years ago

var $ = []

![] == false because [] exists.

false + [] == 'false' because anything added to an array will become whatever that is as a string plus the contents inside the array.

2 + [] is also a string "2"

2 + [2,2] will become "22,2" (string)

hencq2• 16 years ago

Wow, I knew the + operator was weird, but didn't realise it allowed you to do stuff like that.

What I don't get though, wouldn't you still need to call eval() on it to do anything with it? Or does javascript do a 'implied eval' when you try to call a string?

hencq2• 16 years ago

Ah found the answer to my own question in the reddit thread about the same thing: http://www.reddit.com/r/programming/comments/f6xto/_/c1dr729

xtacy• 16 years ago

I saw these long back in a forum that listed such expressions for all printable characters; I am unable to locate them now. Can someone help? Thanks!

noibl• 16 years ago

See Paul Irish's comment: http://adamcecc.blogspot.com/2011/01/javascript.html?showCom...

paulirish• 16 years ago

Here's a converter from regular JS to using a subset of these characters: http://discogscounter.getfreehosting.co.uk/js-noalnum_com.ph...

And the forum thread where this technique was explored at length: http://sla.ckers.org/forum/read.php?24,33349,33405

Superfun. :D

citrus• 16 years ago

"jjencode" generates more short code: http://utf-8.jp/public/jjencode.html

And "aaencode" Encode any JavaScript program to emoticons: http://utf-8.jp/public/aaencode.html

blago2• 16 years ago

I'm missing the purpose. Can someone explain?

jrockway• 16 years ago

Some people think that they can secure their sites against XSS by regexing all the "bad JavaScript" out. If the "security software" sees "document.cookie", then it stops the script from executing. (Or it just replaces it with the empty string, etc.)

Problem is, there are a lot of ways to say document.cookie, and a blacklist is going to miss one of them.

Moral of the story: if people can execute scripts on your page, you're 0wned. Everyone competent knows this, but sometimes the less competent are slow to realize this.

So, the script that the article describes is for their benefit. Good luck writing a regex to stop this one...

(There are also even simpler "exploits", if you regex document.cookie to the empty string, then "document.document.cookiecookie" regexes to "document.cookie". Ooops.)

blago2• 16 years ago

Very naive indeed. I guess I was overwhelmed by the lack of wow :-) Thanks for the context.

patrickaljord• 16 years ago

> Problem is, there are a lot of ways to say document.cookie

Could you give an example?

michaelty• 16 years ago

I wonder if you could use this in an interview...

weixiyen2• 16 years ago

This is great idea, if your goal is to not hire anyone.

bl4k• 16 years ago

except HN readers

gcb6• 16 years ago

easy. show it to him and ask "in 1 to 5, how does that code look like the code you ship to production currently".

any answer other than "Zero" or "wtf-look", do not hire.

Natsu3• 16 years ago

> any answer other than "Zero" or "wtf-look", do not hire.

What if you're hiring someone to test for XSS exploits?

Mc_Big_G• 16 years ago

Perl puts that ugliness to shame.

wmwong• 16 years ago

I'm a little confused. It seems like he didn't need to call the sort function in order to call the alert function. Is this correct? He could have built the alert call in the same manner and just call it by itself. I assume the sort function was thrown in there for a larger example?

bradshaw1965• 16 years ago

The reddit link in the post right above yours explains that sort is used to get a reference to the "window" object since sort returns "this" and by assigning it to a variable it returns the default context which in this case is "window".

gcb6• 16 years ago

why he needed $=[$=[]] and not just $=[[]]

tlrobinson4• 16 years ago

The second $ (which is actually the first assignment) was used as as an alias to [] before the first $ gets assigned. I guess to reduce the number of characters.

gcb6• 16 years ago

it actually increases the number of chars.

inner $=[] will be overwritten by outer $=[$], which is the same as $=[[]]

or am i missing something?

perssontm• 16 years ago

If all those blackhat-efforts could be put to better use somewhere.. although its fascinating what _can_ be done. They are truly creative in their own way. :)

bobds• 16 years ago

This is pretty cool. Reminds me of a Defcon presentation that only used whitespace characters to encode the script (and a bit of boilerplate). I think it looks less suspicious than lots of symbols lumped together.

Here it is: https://www.defcon.org/html/links/dc-archives/dc-16-archive....

https://www.defcon.org/images/defcon-16/dc16-presentations/d...

gbog• 16 years ago

Searching for this string on Google, as I have no access to blogspot, I fell down on http://asdfg.jodi.org (js art, NSFW and may kill your browser). It is related, somewhat.

verysimple• 16 years ago

For those like me who stumble upon this type of js expressions for the first time and are scratching their heads, John Resig (of jQuery fame) attempted some basic explanations in this old HN post:

http://news.ycombinator.com/item?id=1154338

messel• 16 years ago

The perfect gag gift for a new dev team member. "this is an example of our coding style"

Natsu3• 16 years ago

Is it bad that I first tried to interpret it as Perl, even though it was clearly labeled as JavaScript?

ohashi• 16 years ago

This post makes me feel dumb. :(

JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )

Related Stories