search

aemkei / jsfuck

Write any JavaScript with 6 Characters: []()!+
jsfuck.com
Do What The F*ck You Want To Public License
8.07k stars 671 forks source link

Simply crack JSFuck, is there a better encryption? #99

Open xiaoer3301 opened 4 years ago

xiaoer3301 commented 4 years ago

The developer tool can directly print out the source code, and execute the following code in the developer tool. Decryption method:

let func = [][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])
console.log(func)

Output code

ƒ anonymous(
) {
alert(1)
}
subzey commented 4 years ago

Maybe @aemkei proves me wrong, but as far as I know, jsfuck is not about XSS payloads and obfuscations.

It's about recreational programming, limits, and creativity: can you write arbitrary functional JavaScript code using only 6 characters? If yes, what's the shortest way to do it? Or could it be done with 5 charaters?

Though the golfed code is often looks almost unreadable, the obfuscation in sake of obfuscation is not a goal.

kamil-kielczewski commented 4 years ago

@subzey I think JSF is mainly to show that you can write executable cody using only 6 chars (which is actually not trivial and surprising). However here https://github.com/aemkei/jsfuck/issues/70 was my old proposition of compression such code (because I think there is a lot of places where many kinds of size-optimisation can be introduced)

aemkei commented 4 years ago

You are right, JSFuck is "easy" to obfuscate, once you know the basic concepts. Removing the last () from the converted sources will not execute the code but return the inner function.

As @subzey said: The goal here is not to build an obfuscation library that can be used to attack websites, but to show how far we can go by reducing the language to an absolute minimum.