Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 20 down vote favorite
9

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I want to show it while a presentation as an example of state of the art XSS. Or what are other really surprising XSS examples?

share|improve this question
1  
It's worth pointing out that this is only a XSS vulnerability if your site executes javascript code that could be provided by untrusted users and your only safeguard is blacklisting certain keywords (which is the wrong solution). You should always use a whitelist policy/safer markup language that prevents users from executing javascript code (e.g., in comments they can't insert <script> tags, add onclick/onhover-type methods to html tags, or use eval on user provided input in your js, etc.). Then this just is obsfuscation. – dr jimbob Dec 15 '11 at 22:08

2 Answers

up vote 17 down vote accepted

Found it

Converter to convert normal JS into brackets only JS:

share|improve this answer
2  
wow I didn't even think that was possible! time to modify my code filters! (and the next time somebody asks for an obfuscated program on codegolf.stackexchange.com I'll use this :) – Nate Koppenhaver Oct 20 '11 at 1:24
3  
Wow. I'll confess, when I read your question, I thought, "Man, this guy really doesn't know what the hell he's talking about." (I've been writing JavaScript for years.) Now, seeing this? Head asplode. – chrisallenlane Dec 15 '11 at 15:13
up vote 5 down vote

This is an interesting find!

To those who are only just now finding out...

It is now obvious how you can create strings out of braces, and you could do things like window[gibberish](gibberish) to eval something. What may not be clear is that you can do this without the word window. All you need is a variable name (like $ or _)

Run this prep code

$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_]

You will have a function.

Run this to call alert(0) on that function

$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();

Source

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.