Tuesday, March 8, 2016

CodeSOD: JavaScript Obfuscation

We have to be careful about the articles we publish on TDWTF. We have a responsibility to our submitters, to protect their identity and anonymize the details of their stories. We have a responsibility to our readers- mostly to be entertaining.

Last week’s JSF–k story failed one of our readers. Poor Blazej didn’t find it entertaining- it gave him upsetting flashbacks to his own experience with a similar event.

You see, Blazej was pitching in on a file uploading site, specifically meant to share videos. While he did some backend work, the front-end developers wanted to make sure that it was impossible to ever learn the actual URL of a video, to prevent people from downloading it. They wrote some JavaScript to obfuscate that URL, but that introduced a new problem: somebody could just read their JavaScript!

Using the same principles as JSF–k, but coupled with JavaScript’s unicode support, they produced this:

゚ω゚ノ= /`m´)ノ ~┻━┻   //*´∇`*/ ['_']; o=(゚ー゚)  =_=3; c=(゚Θ゚) =(゚ー゚)-(゚ー゚); (゚Д゚) =(゚Θ゚)= (o^_^o)/ (o^_^o);(゚Д゚)={゚Θ゚: '_' ,゚ω゚ノ : ((゚ω゚ノ==3) +'_') [゚Θ゚] ,゚ー゚ノ :(゚ω゚ノ+ '_')[o^_^o -(゚Θ゚)] ,゚Д゚ノ:((゚ー゚==3) +'_')[゚ー゚] }; (゚Д゚) [゚Θ゚] =((゚ω゚ノ==3) +'_') [c^_^o];(゚Д゚) ['c'] = ((゚Д゚)+'_') [ (゚ー゚)+(゚ー゚)-(゚Θ゚) ];(゚Д゚) ['o'] = ((゚Д゚)+'_') [゚Θ゚];(゚o゚)=(゚Д゚) ['c']+(゚Д゚) ['o']+(゚ω゚ノ +'_')[゚Θ゚]+ ((゚ω゚ノ==3) +'_') [゚ー゚] + ((゚Д゚) +'_') [(゚ー゚)+(゚ー゚)]+ ((゚ー゚==3) +'_') [゚Θ゚]+((゚ー゚==3) +'_') [(゚ー゚) - (゚Θ゚)]+(゚Д゚) ['c']+((゚Д゚)+'_') [(゚ー゚)+(゚ー゚)]+ (゚Д゚) ['o']+((゚ー゚==3) +'_') [゚Θ゚];(゚Д゚) ['_'] =(o^_^o) [゚o゚] [゚o゚];(゚ε゚)=((゚ー゚==3) +'_') [゚Θ゚]+ (゚Д゚) .゚Д゚ノ+((゚Д゚)+'_') [(゚ー゚) + (゚ー゚)]+((゚ー゚==3) +'_') [o^_^o -゚Θ゚]+((゚ー゚==3) +'_') [゚Θ゚]+ (゚ω゚ノ +'_') [゚Θ゚]; (゚ー゚)+=(゚Θ゚); (゚Д゚)[゚ε゚]='\\'; (゚Д゚).゚Θ゚ノ=(゚Д゚+ ゚ー゚)[o^_^o -(゚Θ゚)];(o゚ー゚o)=(゚ω゚ノ +'_')[c^_^o];(゚Д゚) [゚o゚]='\"';(゚Д゚) ['_'] ( (゚Д゚) ['_'] (゚ε゚+(゚Д゚)[゚o゚]+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~1)+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~1)+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~1)+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((c^_^o)+(c^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ (!+[]+!+[])+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (o^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((c^_^o)+(c^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (o^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (o^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~1)+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (o^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~1)+ (゚Д゚)[゚ε゚]+(+!+[])+ (!+[]+!+[])+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (!+[]+!+[])+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (+!+[])+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (!+[]+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (-~-~1)+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((o^_^o) +(o^_^o) +(c^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ (+!+[])+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(+!+[])+ (-~-~(!+[]+!+[]))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((゚ー゚) + (゚Θ゚))+ ((゚ー゚) + (゚Θ゚))+ (゚Д゚)[゚ε゚]+(+!+[])+ ((o^_^o) +(o^_^o) +(c^_^o))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o) +(c^_^o))+ (-~-~(!+[]+!+[]))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((゚ー゚) + (o^_^o))+ (゚Д゚)[゚ε゚]+(-~-~(!+[]+!+[]))+ ((c^_^o)+(c^_^o))+ (゚Д゚)[゚ε゚]+((゚ー゚) + (o^_^o))+ (-~-~1)+ (゚Д゚)[゚o゚]) (゚Θ゚)) ('_');

My feelings on this? (⊙…⊙ )

[Advertisement] Universal Package Manager - ProGet easily integrates with your favorite Continuous Integration and Build Tools, acting as the central hub to all your essential components. Learn more today!


To read the full article, please visit The Daily WTF

No comments:

Post a Comment