Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSFuck – Write any JavaScript with 6 Characters: []()!+

jsfuck.com

Post reply on HN
Print view View original

21–30 of 76 posts

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#21

Post by acjohnson55 »

phillmv wrote: post #6
lysium wrote: post #2

While funny looking, what is the ingenuity behind it?

Many people here on HN never took compsci in school, so strictly speaking it's just a translator - http://en.wikipedia.org/wiki/Translator_(computing) . It's more a showoff of a js idiosyncrasy - they found an ugly looking subset of characters that is Turing complete and wrote a translator to it. If you're new to the concept of Turing tarpits, then this should blow your mind. On the other hand, this is a sufficiently…

I'm not sure it's a translator by that definition. The input and output are legal Javascript. It's moreso a demonstration of a functionally complete subset of the language.

You can get all the primitive values by taking advantage of unary plus, binary +, empty arrays, array dereferencing, function calls, and the standard strings returned by some basic expressions. The numbers are straightforward. The strings are dereferenced with numbers to get some individual letters. You can get methods by using array dereference on objects with strings. You get the rest of the letters with btoa and atob. Then you get eval, and you're off to the races!

I'm sure, but I think the encoder just goes token by token, eval'ing string conversions to get identifiers. You'll notice that for pretty simple expressions you get absurdly long strings out.

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#22

Post by jayrox »

zekenie wrote: post #14

I put in alert('hello') and it worked. That's awesome. But how? I searched the code it made and didn't see 'hello.' I understand the stuff below, how it uses JS's weird properties to the basic types... but how does it encode characters?

i imagine it is using bit shifts similar to brainfuck http://en.wikipedia.org/wiki/Brainfuck

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#23

Post by k__ »

CWIZO wrote: post #11
aroman wrote: post #9

Seems like it would be interesting to use as a cheap form of JS obfuscation.

Even 'alert(1)' produces over 500 chars. Imagine running a proper app trough this. It's hardly cheap.

It's probably easier (and much smaller) to put all js in a file, convert it to a data-URI and add it into the html.

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#24

Post by IgorPartola »

I saw a very cool security talk a few years ago about how you can use the browser to do all kinds of evil things (did you know that the Same Origin Policy does not prevent you from making the request, but just seeing the response? And even then, you can guess at what kind of response you got).

One of the great points in the talk was JS obfuscation. Now, there are many techniques for doing this, but I really like this one as it just looks cool. Since you can translate most functional JS into ASCII, you simply encode every character into a binary coding using spaces for 0 and tabs for 1. Then you write a very simple converter + put an eval() around it, and viola, you are running arbitrary code. To a casual observer it would look like you have delivered a mostly empty file, while in fact you are delivering perfectly valid JS. Not unbreakable, but certainly fun.

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#26

Post by CWIZO »

k__ wrote: post #23
CWIZO wrote: post #11

Earlier quoted context omitted.

Even 'alert(1)' produces over 500 chars. Imagine running a proper app trough this. It's hardly cheap.

It's probably easier (and much smaller) to put all js in a file, convert it to a data-URI and add it into the html.

That isn't obsfucation though.

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#27

Post by phillmv »

acjohnson55 wrote: post #21
phillmv wrote: post #6

Earlier quoted context omitted.

Many people here on HN never took compsci in school, so strictly speaking it's just a translator - http://en.wikipedia.org/wiki/Translator_(computing) . It's more a showoff of a js idiosyncrasy - they found an ugly looking subset of characters that is Turing complete and wrote a translator to it. If you're new to the concept of Turing tarpits, then this should blow your mind. On the other hand, this is a sufficiently…

I'm not sure it's a translator by that definition. The input and output are legal Javascript. It's moreso a demonstration of a functionally complete subset of the language. You can get all the primitive values by taking advantage of unary plus, binary +, empty arrays, array dereferencing, function calls, and the standard strings returned by some basic expressions. The numbers are straightforward. The strings are dere…

>I'm not sure it's a translator by that definition. The input and output are legal Javascript. It's moreso a demonstration of a functionally complete subset of the language.

Well, okay, so it's still strictly speaking javascript but if we consider the functionally complete subset to be our 'target' language we end up in the same place, methinks :).

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#29

Post by aroman »

CWIZO wrote: post #11
aroman wrote: post #9

Seems like it would be interesting to use as a cheap form of JS obfuscation.

Even 'alert(1)' produces over 500 chars. Imagine running a proper app trough this. It's hardly cheap.

cheap as in stupidly simple, relatively computationally inexpensive and largely ineffective. Not as in having a low storage overhead.
Post reply on HN