5 ms·

I'm not accusing the author of doing this, but providing a simple base64 encoded blob at the end to run to enable everything would be a pretty easy attack vecto

I'm not accusing the author of doing this, but providing a simple base64 encoded blob at the end to run to enable everything would be a pretty easy attack vector, wouldn't it? edit: just decoded it and touché

berbec 3y ago
For those to lazy to run base64 --decode, here's the result: // Here's a cake if you thought about inspecting the code before executing it: let css = 'font-size: 36px; font-weight: bold; color: red'; console.log("%cNEVER paste code you don't understand into the development console.", css); console.log("%cThis is the best way to compromise your account.", css);
- mythz 3y ago
  > For those to lazy to run base64 --decode, here's the result: Or just strip the eval and use JS's native base64 decoder: atob(base64)
  - _joel 3y ago
    "Don't cross the streams!", although I take your point...
  - SamuelAdams 3y ago
    CyberChef has been my go to for a while for this sort of stuff. Easy to use GUI, can stack multiple commands fairly easily. https://gchq.github.io/CyberChef/ https://gchq.github.io/CyberChef/
- notpachet 3y ago
  Wow, I had zero idea you could use string substitution for formatting console.log messages. (Although I guess if I'd stopped and thought about it, there had to be something enabling those big scary messages in the console for certain websites...)
  - deleted 3y ago
    [deleted]
- someguy7250 3y ago
  > NEVER paste code you don't understand into the development console Tech companies have long achieved security by simply locking people out of choices that they shouldn't make. I'm suspecting that Google will soon lock people out of Chrome's developer tools unless they can prove they are a developer (with a certificate that's tied to the website they are debugging)
  - memefrog 3y ago
    Use Firefox!
  - _27qf 3y ago
    > with a certificate that's tied to the website they are debugging And they will tell us this is for our own security!

berbec 3y ago

For those to lazy to run base64 --decode, here's the result: // Here's a cake if you thought about inspecting the code before executing it: let css = 'font-size: 36px; font-weight: bold; color: red'; console.log("%cNEVER paste code you don't understand into the development console.", css); console.log("%cThis is the best way to compromise your account.", css);

mythz 3y ago
> For those to lazy to run base64 --decode, here's the result: Or just strip the eval and use JS's native base64 decoder: atob(base64)
- _joel 3y ago
  "Don't cross the streams!", although I take your point...
- SamuelAdams 3y ago
  CyberChef has been my go to for a while for this sort of stuff. Easy to use GUI, can stack multiple commands fairly easily. https://gchq.github.io/CyberChef/ https://gchq.github.io/CyberChef/
notpachet 3y ago
Wow, I had zero idea you could use string substitution for formatting console.log messages. (Although I guess if I'd stopped and thought about it, there had to be something enabling those big scary messages in the console for certain websites...)
- deleted 3y ago
  [deleted]
someguy7250 3y ago
> NEVER paste code you don't understand into the development console Tech companies have long achieved security by simply locking people out of choices that they shouldn't make. I'm suspecting that Google will soon lock people out of Chrome's developer tools unless they can prove they are a developer (with a certificate that's tied to the website they are debugging)
- memefrog 3y ago
  Use Firefox!
- _27qf 3y ago
  > with a certificate that's tied to the website they are debugging And they will tell us this is for our own security!