33

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I want to show it while a presentation as an example of state of the art XSS. Or what are other really surprising XSS examples?

Improve this question
1
  • 1
    It's worth pointing out that this is only a XSS vulnerability if your site executes javascript code that could be provided by untrusted users and your only safeguard is blacklisting certain keywords (which is the wrong solution). You should always use a whitelist policy/safer markup language that prevents users from executing javascript code (e.g., in comments they can't insert <script> tags, add onclick/onhover-type methods to html tags, or use eval on user provided input in your js, etc.). Then this just is obsfuscation.
    – dr jimbob
    Commented Dec 15, 2011 at 22:08

2 Answers 2

Reset to default
27

Found it

Converter to convert normal JS into brackets only JS:

Improve this answer
2
  • 2
    wow I didn't even think that was possible! time to modify my code filters! (and the next time somebody asks for an obfuscated program on codegolf.stackexchange.com I'll use this :)
    – Nate Koppenhaver
    Commented Oct 20, 2011 at 1:24
  • 3
    Wow. I'll confess, when I read your question, I thought, "Man, this guy really doesn't know what the hell he's talking about." (I've been writing JavaScript for years.) Now, seeing this? Head asplode.
    – Chris Allen Lane
    Commented Dec 15, 2011 at 15:13
7

This is an interesting find!

To those who are only just now finding out...

It is now obvious how you can create strings out of braces, and you could do things like window[gibberish](gibberish) to eval something. What may not be clear is that you can do this without the word window. All you need is a variable name (like $ or _)

Run this prep code

$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_]

You will have a function.

Run this to call alert(0) on that function

$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();

Source

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .