8

Saw some top 200 web sites (by Alexa) using obfuscation in the javascript code. Any ideas on why they do it? My guess is that they do it to prevent data scraping, but not sure. Thanks.

youtube enter image description here

Booking.com enter image description here enter image description here

  • 3
    Breaking up a closing script tag in inline scripts is done to prevent closing a script tag early. That doesn't quite cover all of this though. – Alexander O'Mara Jun 30 '16 at 23:24
  • 1
    IMHO, It doesn't look obfuscated (as to hide the real meaning). It seems more like minimized and optimized, something similar to Google Closure Compiler or UglifyJS. If they really wanted to obfuscate it, it would look more like garbage, but we can still understand something that the code is doing in these cases. – lepe Jul 1 '16 at 1:37
3

You got good information from the answer and commentary, but, they didn't exactly answer the question.

The reason obfuscated code is used depends on the author.

The author is a jerk: If the author is writing malware, un-obfuscated code can be easily parsed by malware checkers using signatures, presence of tokens, pre-compiling, and other methods. The author in this case wants the malware to spread, so, code is obfuscated to attempt to avoid detection.

(note, this is not legit, so, doesn't answer your question; but I added it for posterity)

The author is using patented code: If the author is writing proprietary code, whether in the java/vbscript or in the ActiveX library it is using, obfuscated code is the programmer's way to prevent the casual hacker from learning about, and possibly exploiting, stealing, profiting from, or giving away these secrets.

The author is using secret functions: If the author is writing code which uses secret (unpublished) functions in ActiveX libraries, obfuscating the access to those functions can mitigate the casual hacker from seeing, using, and exploiting this code. Although a dangerous practice, sometimes, programmers use "backdoor" logic - something which doesn't require authentication, or expensive checks and balances, etc. This kind of code is sometimes called "debug" code - something temporary, or something which is deliberately left in production, and which "shouldn't" be used.

The author is hardcoding a password: If the author is writing code which is hard-coding protected information (a password), the author may want to keep this information hidden from the casual hacker or a bot.

The author is hardcoding an email: If the author is writing code which is hard-coding an email (say, as part of a "contact us" link), the author may want to keep this information hidden from bots which look for emails to send spam to.

The author is using deprecated or beta code: If the author is writing code which is using functions which are not intended to be used in regular production - say, the code is deprecated or is in beta/alpha - then obfuscating it will mitigate anyone trying to copy, use, document, or rely on this. Here, there's no attempt to harm someone's computer, or to steal code.

The author us using good code which triggers a false-positive: If the author is writing code which happens to have a signature which is known to trigger a false-positive by virus checkers, the author might try to mitigate this by obfuscating the code, so as not to trigger the alarm. This may seem like similar to the first scenario, except that in the first, the author is malevolent, whereas in this case, the author is not trying to subvert anyone's system.

The Casual Hacker: Note that any determined hacker will see through all of this and easily parse the code as needed. Content security is generally considered a holy grail. Anything sent to a client must be decrypted, decoded, or de-obfuscated before being used, and therein lies the weakness: once decrypted, decoded, or de-obfuscated, the content is accessible.

6

It's not obfuscated script. it's only minimized script for faster loading purposes.

These are some sample scripts.

Normal Script:

StackExchange.ready(function() {
    StackExchange.using("postValidation", function() {
        StackExchange.postValidation.initOnBlurAndSubmit($('#post-form'), 2, 'answer');
    });

    StackExchange.question.init({
        showAnswerHelp: true,
        totalCommentCount: 2,
        shownCommentCount: 2,
        highlightColor: '#F4A83D',
        backgroundColor: '#FFF',
        questionId: 128839
    });
    styleCode();
    StackExchange.realtime.subscribeToQuestion('162', '128839');
    StackExchange.using("gps", function() {
        StackExchange.gps.trackOutboundClicks('#content', '.post-text');
    });
});

Minimized Script:

StackExchange.ready(function(){StackExchange.using("postValidation",function(){StackExchange.postValidation.initOnBlurAndSubmit($('#post-form'),2,'answer')});StackExchange.question.init({showAnswerHelp:true,totalCommentCount:2,shownCommentCount:2,highlightColor:'#F4A83D',backgroundColor:'#FFF',questionId:128839});styleCode();StackExchange.realtime.subscribeToQuestion('162','128839');StackExchange.using("gps",function(){StackExchange.gps.trackOutboundClicks('#content','.post-text')})});

Obfuscated Script (using my self method):

var _0x1fc5 = ["\x30\x2E\x38\x28\x31\x28\x29\x7B\x30\x2E\x33\x28\x22\x34\x22\x2C\x31\x28\x29\x7B\x30\x2E\x34\x2E\x39\x28\x24\x28\x27\x23\x35\x2D\x61\x27\x29\x2C\x32\x2C\x27\x62\x27\x29\x7D\x29\x3B\x30\x2E\x63\x2E\x64\x28\x7B\x65\x3A\x66\x2C\x67\x3A\x32\x2C\x68\x3A\x32\x2C\x69\x3A\x27\x23\x6A\x27\x2C\x6B\x3A\x27\x23\x6C\x27\x2C\x6D\x3A\x36\x7D\x29\x3B\x6E\x28\x29\x3B\x30\x2E\x6F\x2E\x70\x28\x27\x71\x27\x2C\x27\x36\x27\x29\x3B\x30\x2E\x33\x28\x22\x37\x22\x2C\x31\x28\x29\x7B\x30\x2E\x37\x2E\x72\x28\x27\x23\x73\x27\x2C\x27\x2E\x35\x2D\x74\x27\x29\x7D\x29\x7D\x29\x3B", "\x7C", "\x73\x70\x6C\x69\x74", "\x53\x74\x61\x63\x6B\x45\x78\x63\x68\x61\x6E\x67\x65\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x7C\x75\x73\x69\x6E\x67\x7C\x70\x6F\x73\x74\x56\x61\x6C\x69\x64\x61\x74\x69\x6F\x6E\x7C\x70\x6F\x73\x74\x7C\x31\x32\x38\x38\x33\x39\x7C\x67\x70\x73\x7C\x72\x65\x61\x64\x79\x7C\x69\x6E\x69\x74\x4F\x6E\x42\x6C\x75\x72\x41\x6E\x64\x53\x75\x62\x6D\x69\x74\x7C\x66\x6F\x72\x6D\x7C\x61\x6E\x73\x77\x65\x72\x7C\x71\x75\x65\x73\x74\x69\x6F\x6E\x7C\x69\x6E\x69\x74\x7C\x73\x68\x6F\x77\x41\x6E\x73\x77\x65\x72\x48\x65\x6C\x70\x7C\x74\x72\x75\x65\x7C\x74\x6F\x74\x61\x6C\x43\x6F\x6D\x6D\x65\x6E\x74\x43\x6F\x75\x6E\x74\x7C\x73\x68\x6F\x77\x6E\x43\x6F\x6D\x6D\x65\x6E\x74\x43\x6F\x75\x6E\x74\x7C\x68\x69\x67\x68\x6C\x69\x67\x68\x74\x43\x6F\x6C\x6F\x72\x7C\x46\x34\x41\x38\x33\x44\x7C\x62\x61\x63\x6B\x67\x72\x6F\x75\x6E\x64\x43\x6F\x6C\x6F\x72\x7C\x46\x46\x46\x7C\x71\x75\x65\x73\x74\x69\x6F\x6E\x49\x64\x7C\x73\x74\x79\x6C\x65\x43\x6F\x64\x65\x7C\x72\x65\x61\x6C\x74\x69\x6D\x65\x7C\x73\x75\x62\x73\x63\x72\x69\x62\x65\x54\x6F\x51\x75\x65\x73\x74\x69\x6F\x6E\x7C\x31\x36\x32\x7C\x74\x72\x61\x63\x6B\x4F\x75\x74\x62\x6F\x75\x6E\x64\x43\x6C\x69\x63\x6B\x73\x7C\x63\x6F\x6E\x74\x65\x6E\x74\x7C\x74\x65\x78\x74", "\x72\x65\x70\x6C\x61\x63\x65", "", "\x5C\x77\x2B", "\x5C\x62", "\x67"]
eval(function(_0x5f63x1, _0x5f63x2, _0x5f63x3, _0x5f63x4, _0x5f63x5, _0x5f63x6) {
        _0x5f63x5 = function(_0x5f63x3) {
            return _0x5f63x3.toString(_0x5f63x2)
        };
        if (!_0x1fc5[5][_0x1fc5[4]](/^/, String)) {
            while (_0x5f63x3--) {
                _0x5f63x6[_0x5f63x5(_0x5f63x3)] = _0x5f63x4[_0x5f63x3] || _0x5f63x5(_0x5f63x3)
            }
            _0x5f63x4 = [function(_0x5f63x5) {
                return _0x5f63x6[_0x5f63x5]
            }];
            _0x5f63x5 = function() {
                return _0x1fc5[6]
            };
            _0x5f63x3 = 1
        };
        while (_0x5f63x3--) {
            if (_0x5f63x4[_0x5f63x3]) {
                _0x5f63x1 = _0x5f63x1[_0x1fc5[4]](new RegExp(_0x1fc5[7] + _0x5f63x5(_0x5f63x3) + _0x1fc5[7], _0x1fc5[8]), _0x5f63x4[_0x5f63x3])
            }
        }
        return _0x5f63x1
    }
    (_0x1fc5[0], 30, 30, _0x1fc5[3][_0x1fc5[2]](_0x1fc5[1]), 0, {}))

See, those 3 scripts above are same (equal).

  • @Priyank Gupta: thanks for your grammar correction. Pardon me for my bad English :) – Fadhly Permata Jul 1 '16 at 6:49
  • 2
    I disagree, look what have been highlighted in yellow, this has nothing to do with minification. scrip+t, s\u0072c. That is not minification. – Walfrat Jul 1 '16 at 7:06
  • ya, you're right if focusing into highlighted script only.. But for a programmer (which will look at the blocks of code), that is not obfuscated script, because its still easy to read.. like scrip+t or s\u0072c its still look as a normal syntax (for programmer) scrip+t for script and s\u0072c for src. its only unicode. Typically, javascript programmer using packer by dean http://dean.edwards.name/packer/ to obfuscating they script. you can test obfuscating script in there. and see the result. it's not easy to read. – Fadhly Permata Jul 1 '16 at 7:27
  • Refer from https://javascriptobfuscator.com/ What Is Javascript Obfuscator? Javascript Obfuscator converts the JavaScript source code into obfuscated and completely unreadable form, preventing it from analysing and theft. So, the obfuscating was failed, if the programmer using those method only. Since they code is still readable. – Fadhly Permata Jul 1 '16 at 7:32
  • So it's a kind of custom obfuscation that may just work on some widespread bot but won't work if someone is really looking into it what i meant is that clearly some part of the code isn't minification, it can be consider as a bad (or old) way of obfuscating ? – Walfrat Jul 1 '16 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.