Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSFuck – Write any JavaScript with 6 Characters: []()!+

jsfuck.com

Post reply on HN
Print view View original

31–40 of 76 posts

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#31

Post by nilliams »

IgorPartola wrote: post #24

I saw a very cool security talk a few years ago about how you can use the browser to do all kinds of evil things (did you know that the Same Origin Policy does not prevent you from making the request, but just seeing the response? And even then, you can guess at what kind of response you got). One of the great points in the talk was JS obfuscation. Now, there are many techniques for doing this, but I really like this…

Was it Billy Hoffman's 'JavaScript the Evil Parts'? http://blip.tv/jsconf/billy-hoffman-javascript-the-evil-part...

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#32

Post by talles »

MattBearman wrote: post #30
talles wrote: post #28

"JSFuck is an esoteric and educational programming style" How exactly is this educational?

I took the 'educational' to mean 'this should never be used in a real application' :)

If someone cogitates to use this for real... it shouldn't be doing it anything at all.

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#34

Post by penguat »

I don't think this was written with the output size of the code much in mind. In one example, there was: [+[[!+[]+!+[]]]]

Which breaks down to: [!+[]+!+[]] === [2] +[[!+[]+!+[]]] === 2 [+[[!+[]+!+[]]]] === [2] //again

So I think there might be quite a bit of scope for compression even within the parameters it's built in.

Highly impressive, in any case.

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#35

Post by mjhoy »

zekenie wrote: post #14

I put in alert('hello') and it worked. That's awesome. But how? I searched the code it made and didn't see 'hello.' I understand the stuff below, how it uses JS's weird properties to the basic types... but how does it encode characters?

Try it letter by letter.

For instance, to get the string "a":

    (![]+[])[+[[+!+[]]]]
Take the first part, `(![]+[])`. `![]` evaluates to `false`. Then `+[]` coerces false into a string, so the expression is `"false"`.

The rest of the expression (more complicated) evaluates to `[[1]]`, which will grab the `"a"` from `"false"`. Now why there is the extra surrounding brackets, I'm not sure, because `[1]` would have worked as well.

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#36

Post by tonyarkles »

bifel wrote: post #10
ig1 wrote: post #5

Earlier quoted context omitted.

It means it can bypass any automatic "javascript filters" which try and filter out malicious js code while allowing legitimate code.

so does any eval'd code

Unless eval is special-cased to get the evil bit set.

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#37

Post by prezjordan »

talles wrote: post #28

"JSFuck is an esoteric and educational programming style" How exactly is this educational?

It teaches you the funky behavior of JavaScript. For instance, `[]["filter"]` returns an empty function called filter.

In order to get particular characters (for example: f), the script uses "false"[0], where "false" is derived from adding ![] + [], and 0 is derived from +[].

Putting all of that together ($ node):

> (![]+[])[+[]]

'f'

Re: JSFuck – Write any JavaScript with 6 Characters: []()!+

#39

Post by k__ »

CWIZO wrote: post #26
k__ wrote: post #23

Earlier quoted context omitted.

It's probably easier (and much smaller) to put all js in a file, convert it to a data-URI and add it into the html.

That isn't obsfucation though.

I don't know if the stuff mentioned here isn't reversable. I never tried it (just with images), wouldn't this not just show a big blob in the HTML file?
Post reply on HN