Currently, there is only 5 characters in the HN headline: "[]()+". Maybe a mod removed the "!" because they thought it was being used for emphasis. It could be placed before the "+".
[deleted]
JSFuck – Write any JavaScript with 6 Characters: []()!+
41–50 of 76 posts
Re: JSFuck – Write any JavaScript with 6 Characters: []()!+
#42Seems like it would be interesting to use as a cheap form of JS obfuscation.
It wouldn't be a good way to obfuscate at all! The step before the eval would be completely decipherable.
Also, not cheap!
Re: JSFuck – Write any JavaScript with 6 Characters: []()!+
#43I saw a very cool security talk a few years ago about how you can use the browser to do all kinds of evil things (did you know that the Same Origin Policy does not prevent you from making the request, but just seeing the response? And even then, you can guess at what kind of response you got). One of the great points in the talk was JS obfuscation. Now, there are many techniques for doing this, but I really like this…
Was it Billy Hoffman's 'JavaScript the Evil Parts'? http://blip.tv/jsconf/billy-hoffman-javascript-the-evil-part...
Yes, that's the one.
Re: JSFuck – Write any JavaScript with 6 Characters: []()!+
#44Re: JSFuck – Write any JavaScript with 6 Characters: []()!+
#45How long will it take till we see a decompiler? :D
It creates a string of code. so it already ecodes.
Re: JSFuck – Write any JavaScript with 6 Characters: []()!+
#46Re: JSFuck – Write any JavaScript with 6 Characters: []()!+
#47The woe that is Atwood's Law.
Re: JSFuck – Write any JavaScript with 6 Characters: []()!+
#48I put in alert('hello') and it worked. That's awesome. But how? I searched the code it made and didn't see 'hello.' I understand the stuff below, how it uses JS's weird properties to the basic types... but how does it encode characters?
Try it letter by letter. For instance, to get the string "a": (![]+[])[+[[+!+[]]]] Take the first part, `(![]+[])`. `![]` evaluates to `false`. Then `+[]` coerces false into a string, so the expression is `"false"`. The rest of the expression (more complicated) evaluates to `[[1]]`, which will grab the `"a"` from `"false"`. Now why there is the extra surrounding brackets, I'm not sure, because `[1]` would have worked…
It looks like the generator is suboptimal, but still really cool.
(![]+[])[+!+[]] evaluates to "a" as well. It looks like it turns it into an array twice.
It goes +!+[] === 1 then [+!+[]] === [1] then +[[+!+[]]] === 1 then [+[[+!+[]]]] === [1]
Re: JSFuck – Write any JavaScript with 6 Characters: []()!+
#49I saw a very cool security talk a few years ago about how you can use the browser to do all kinds of evil things (did you know that the Same Origin Policy does not prevent you from making the request, but just seeing the response? And even then, you can guess at what kind of response you got). One of the great points in the talk was JS obfuscation. Now, there are many techniques for doing this, but I really like this…
I recently did this exact thing for Ruby: https://github.com/dzucconi/negative
Re: JSFuck – Write any JavaScript with 6 Characters: []()!+
#50This is interestingly reminiscent of swearjure[1], clojure without alphanumerics. The IRC log in that post is very enlightening to see how the idea evolved into something absolutely frightening. I would like to see the history of JSFuck.