3 ms·

Can you provide some examples of such sites? I would love to learn more about this technique.

• jc4p 14y ago
  The signature for them is that they start off with: eval(function(p,a,c,k,e,d))... I've seen them most commonly used in not-quite-so-legal streaming websites online where their biggest problem is blocking robots from scraping their site and losing their advertising revenue.
  • tzury 14y ago
    okay then, that's the usual daftlogic's[1] output. I thought you are talking about something new. [1] http://www.daftlogic.com/projects-online-javascript-obfuscator.htm http://www.daftlogic.com/projects-online-javascript-obfuscat...
• drostie 14y ago
  I sometimes `wget` the URLs in my spambox out of genuine curiosity as to what people are actually sending me, and there are a bunch of common patterns. What's very surprising is the "obfuscated eval" statement -- some term which ultimately evaluates to 'window' is queried for something crazy like: w[(typeof 3)[4] + "va" + (document.body + "")[17]] which ultimately is 'eval'. This is often combined with some sort of self-decrypting almost-binary-looking payload hidden in a div somewhere and requested by div.innerHTML. Replacing the "eval" with "console.log" can give you the decrypted payload, usually a redirect to another redirect to something which runs a Flash script, which is where my analysis stops. I am not sure why they do this. My first thought is "to prevent being automatically taken down by The Man", but The Man could afford to automatically dispose of a computer while monitoring its network traffic, rebooting from a fixed disk image like a LiveCD afterwards. So it shouldn't be too hard to automatically discover the domains, IPs, and malicious programs involved. I don't know why you'd obfuscate a redirection.