5 ms·

JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )

• nicksergeant 16y ago
  Well, that was interesting.
• loganlinn 16y ago
  Great use of JavaScript's weird + operator. The whole trick stems from the fact that !$ == false and !$+$ == "false"
  • weixiyen 16y ago
    var $ = [] ![] == false because [] exists. false + [] == 'false' because anything added to an array will become whatever that is as a string plus the contents inside the array. 2 + [] is also a string "2" 2 + [2,2] will become "22,2" (string)
  • hencq 16y ago
    Wow, I knew the + operator was weird, but didn't realise it allowed you to do stuff like that. What I don't get though, wouldn't you still need to call eval() on it to do anything with it? Or does javascript do a 'implied eval' when you try to call a string?
    • hencq 16y ago
      Ah found the answer to my own question in the reddit thread about the same thing: http://www.reddit.com/r/programming/comments/f6xto/_/c1dr729 http://www.reddit.com/r/programming/comments/f6xto/_/c1dr729
      • joakin 16y ago
        This is what is missing in the article, thank you
• xtacy 16y ago
  I saw these long back in a forum that listed such expressions for all printable characters; I am unable to locate them now. Can someone help? Thanks!
  • noibl 16y ago
    See Paul Irish's comment: http://adamcecc.blogspot.com/2011/01/javascript.html?showComment=1295666584419#c4861796849333913434 http://adamcecc.blogspot.com/2011/01/javascript.html?showCom...
• paulirish 16y ago
  Here's a converter from regular JS to using a subset of these characters: http://discogscounter.getfreehosting.co.uk/js-noalnum_com.php http://discogscounter.getfreehosting.co.uk/js-noalnum_com.ph... And the forum thread where this technique was explored at length: http://sla.ckers.org/forum/read.php?24,33349,33405 http://sla.ckers.org/forum/read.php?24,33349,33405 Superfun. :D
  • citrus 16y ago
    "jjencode" generates more short code: http://utf-8.jp/public/jjencode.html http://utf-8.jp/public/jjencode.html And "aaencode" Encode any JavaScript program to emoticons: http://utf-8.jp/public/aaencode.html http://utf-8.jp/public/aaencode.html
    • deleted 16y ago
      [deleted]
• deleted 16y ago
  [deleted]
• blago 16y ago
  I'm missing the purpose. Can someone explain?
  • jrockway 16y ago
    Some people think that they can secure their sites against XSS by regexing all the "bad JavaScript" out. If the "security software" sees "document.cookie", then it stops the script from executing. (Or it just replaces it with the empty string, etc.) Problem is, there are a lot of ways to say document.cookie, and a blacklist is going to miss one of them. Moral of the story: if people can execute scripts on your page, you're 0wned. Everyone competent knows this, but sometimes the less competent are slow to realize this. So, the script that the article describes is for their benefit. Good luck writing a regex to stop this one... (There are also even simpler "exploits", if you regex document.cookie to the empty string, then "document.document.cookiecookie" regexes to "document.cookie". Ooops.)
    • blago 16y ago
      Very naive indeed. I guess I was overwhelmed by the lack of wow :-) Thanks for the context.
    • patrickaljord 16y ago
      > Problem is, there are a lot of ways to say document.cookie Could you give an example?
      • JeremyBanks 16y ago
        Using the converter linked above[1] I can convert alert(document.cookie) to the equivalent ([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]])(([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[([][[]]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+[]]+((+[])[([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]])[([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+[][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+[+[]])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]) [1] http://news.ycombinator.com/item?id=2129815
• michaelty 16y ago
  I wonder if you could use this in an interview...
  • weixiyen 16y ago
    This is great idea, if your goal is to not hire anyone.
    • bl4k 16y ago
      except HN readers
      • gokhan 16y ago
        How many of them can understand this?
        • jonursenbach 16y ago
          Before or after this article was posted?
  • gcb 16y ago
    easy. show it to him and ask "in 1 to 5, how does that code look like the code you ship to production currently". any answer other than "Zero" or "wtf-look", do not hire.
    • Natsu 16y ago
      > any answer other than "Zero" or "wtf-look", do not hire. What if you're hiring someone to test for XSS exploits?
      • MichaelApproved 16y ago
        Testing for XSS exploits isn't production code so the answer should still be zero.
• deleted 16y ago
  [deleted]
• Mc_Big_G 16y ago
  Perl puts that ugliness to shame.
• wmwong 16y ago
  I'm a little confused. It seems like he didn't need to call the sort function in order to call the alert function. Is this correct? He could have built the alert call in the same manner and just call it by itself. I assume the sort function was thrown in there for a larger example?
  • bradshaw1965 16y ago
    The reddit link in the post right above yours explains that sort is used to get a reference to the "window" object since sort returns "this" and by assigning it to a variable it returns the default context which in this case is "window".
• gcb 16y ago
  why he needed $=[$=[]] and not just $=[[]]
  • tlrobinson 16y ago
    The second $ (which is actually the first assignment) was used as as an alias to [] before the first $ gets assigned. I guess to reduce the number of characters.
    • gcb 16y ago
      it actually increases the number of chars. inner $=[] will be overwritten by outer $=[$], which is the same as $=[[]] or am i missing something?
      • tlrobinson 16y ago
        It doesn't get overwritten until the rest of the expression has been evaluated, thus $ == [] for all the uses of $ within the expression.
        • gcb 16y ago
          still not clear. the code unobfuscated is: (a=[a=[]]['sort'])()['alert'](1) my argument is that this is the same, and less chars (a=[]['sort'])()['alert'](1) I can't see any benefit of the encapsulation of the array assignment there. edit: also, just noticed that my previous comments i was writting $=[[]] when i was thinking of $=[], but both works the same, and are still less chars :)
          • gcb 16y ago
            ($=[][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+ ($$=($_=!''+$)[_/_]+$_[+[]])])()[__[_/_]+__ [_+~$]+$_[_]+$$](_/_) on the last string trick to write 'sort' it fails if there's no $=[$=[]] all the other parts just $=[] works just fine. and they are in the same scope as the 't' i can't understand
          • 16y ago
• perssontm 16y ago
  If all those blackhat-efforts could be put to better use somewhere.. although its fascinating what _can_ be done. They are truly creative in their own way. :)
• bobds 16y ago
  This is pretty cool. Reminds me of a Defcon presentation that only used whitespace characters to encode the script (and a bit of boilerplate). I think it looks less suspicious than lots of symbols lumped together. Here it is: https://www.defcon.org/html/links/dc-archives/dc-16-archive.html#Kolisar https://www.defcon.org/html/links/dc-archives/dc-16-archive.... https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-kolisar.pdf https://www.defcon.org/images/defcon-16/dc16-presentations/d...
• gbog 16y ago
  Searching for this string on Google, as I have no access to blogspot, I fell down on ​http://asdfg.jodi.org http://asdfg.jodi.org (js art, NSFW and may kill your browser). It is related, somewhat.
• verysimple 16y ago
  For those like me who stumble upon this type of js expressions for the first time and are scratching their heads, John Resig (of jQuery fame) attempted some basic explanations in this old HN post: http://news.ycombinator.com/item?id=1154338 http://news.ycombinator.com/item?id=1154338
• messel 16y ago
  The perfect gag gift for a new dev team member. "this is an example of our coding style"
  • Natsu 16y ago
    Is it bad that I first tried to interpret it as Perl, even though it was clearly labeled as JavaScript?
• ohashi 16y ago
  This post makes me feel dumb. :(