Executing non-alphanumeric JavaScript without parentheses
blog.portswigger.net
Executing non-alphanumeric JavaScript without parentheses
1–10 of 22 posts
Re: Executing non-alphanumeric JavaScript without parentheses
#2If you want to automate this process: http://www.jsfuck.com/
Re: Executing non-alphanumeric JavaScript without parentheses
#3If you want to automate this process: http://www.jsfuck.com/
As far as I know, JSFuck still uses parentheses.
Re: Executing non-alphanumeric JavaScript without parentheses
#4I found this article had more depth: http://patriciopalladino.com/blog/2012/08/09/non-alphanumeri...
Re: Executing non-alphanumeric JavaScript without parentheses
#5what's the use case? Circumventing code insertion filters?
Re: Executing non-alphanumeric JavaScript without parentheses
#6Re: Executing non-alphanumeric JavaScript without parentheses
#7I found this article had more depth: http://patriciopalladino.com/blog/2012/08/09/non-alphanumeri...
That's a better intro, but the "point" of this article was about doing it without using parenthesis.
Re: Executing non-alphanumeric JavaScript without parentheses
#8I've done something similar with PHP, by casting an array to a string (The string "Array") and using "variable variables". If only there was a way to call functions in PHP without using letters in the code... https://gist.github.com/nubs/5849633#file-nodigitsorquotesei...
Re: Executing non-alphanumeric JavaScript without parentheses
#9what's the use case? Circumventing code insertion filters?
Pretty much - the first paragraph links to an example of this technique being used to exploit Uber's developer documentation - http://blog.portswigger.net/2016/04/adapting-angularjs-paylo...
Re: Executing non-alphanumeric JavaScript without parentheses
#10This article did give me the out-loud-at-the-office chuckle and a whispered "what the f°°°" that only awe-inspiring hacks far above my programming intelligence level can provoke. :)