Questions tagged [javascript]

JavaScript or JS is an interpreted computer programming language. It was originally implemented as part of web browsers.

Filter by
Sorted by
Tagged with
69
votes
9answers
76k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
28
votes
4answers
18k views

What is a good tools to reverse the effects of Minify on JavaScript?

Are there any scripts and/or online tools that can reverse the effects of minification? I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want ...
16
votes
4answers
2k views

Obfuscating JavaScript with zero-width characters - pros and cons?

This comes from comments on a question on StackOverflow about JavaScript Variables: Why aren't ◎ܫ◎ and ☺ valid JavaScript variable names? JavaScript accepts zero-width characters as valid variable ...
16
votes
1answer
110k views

How to deobfuscate an obfuscated javascript file like this? [duplicate]

I'm having serious problems deobfuscating a JavaScript file at work. This file is inside a web app that I was left in charge to improve it. The problem is that I can do it without having access to ...
10
votes
4answers
22k views

Try to deobfuscate multi layered javascript

According to the techy zilla blog It will be much harder to deobfuscate code that has been obfuscated using multiple obfuscating algorithms. According to them, jsbeautifier can't fix this obfuscated ...
7
votes
1answer
2k views

How do I reverse this javascript code? How is it packed?

I've a couple of questions regarding this javascript code, I found injected in one of my web pages. What is this script doing? Which tool is used to pack or obfuscate this script? How can I learn the ...
7
votes
3answers
2k views

Get used jQuery plugins from website

I want to know what jQuery plugins Facebook uses for their special scrollbar, like the two on the left, not the normal one on the right: (source) Generally, how should I go when I want to know what ...
7
votes
1answer
906 views

Reverse engineering XKCD 1190

The latest (as of now) comic is titled "Time". It's a standard-looking comic though without much action, but the picture's alt title says "Wait for it.". I waited but nothing happened (tried in Opera ...
4
votes
3answers
54k views

How to get Video URL from embedded Link in Twitter

I'm trying to get the Video URL of ( https://twitter.com/i/videos/823649890379120640?embed_source=facebook ) I tried going over the source code but it give the same URL link <meta property="og:...
4
votes
3answers
285 views

Obfuscated code analysis - can unused variables be ignored?

I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the ...
3
votes
1answer
55 views

Is there a tool to compare javascript files for differences, while also ignoring local identifier changes?

When trying to compare the difference between two minified javascript files with random identifier names, about 95% of the changes are identifiers being renamed. I would like to use a tool that ...
3
votes
1answer
2k views

Possible to get the full url behind javascript button?

I am programming a little tool for patching. I found the microsoft update catalog, where all updates are stored, and I managed to look for some of them. But my problem is now that the actual download ...
3
votes
1answer
6k views

Analyze obfuscated JavaScript code? [duplicate]

I have this code var _8818;var _7347='...
3
votes
0answers
2k views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
3
votes
0answers
142 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
2
votes
2answers
523 views

How work this obfuscation, and how deobfuscate?

Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§=~[];Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§={___:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$$$$:(![]+"")[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],__$:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$_$_:(![]+"")[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],_$_:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$_$$:({}+"")[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§...
2
votes
2answers
4k views

Deobfuscating a javascript file

I am having a obfuscated JS file and I want to deobfuscate it (and not beautify it). I have seen answer to a similar question here and I tried de-obfuscating a the file using online version of ...
2
votes
1answer
547 views

Decoding Malware javascript [closed]

My .php and .js files have been attacked twice in a month with some JavaScript code. After going through this similar thread, I ran the JavaScript code posted there and found this decoding result. ...
2
votes
1answer
48 views

Load a *.dylib or *.so object into the Javascript V8 runtime?

I was reading this Frida release page and noticed it made the following reference: Short of writing the whole agent in C, one could go ahead and build a native library, and load it using Module....
2
votes
2answers
157 views

How to call an item of a Javascript array?

Say I have the following Javascript array: var _0xe984=[ '\x61\x70\x70\x6c\x79', '\x72\x65\x74\x75\x72\x6e\x20\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x28\x29\x20', '\x7b\x7d\x2e\x63\x6f\x6e\x73\...
2
votes
1answer
7k views

Frida manipulating arguments - Android

I've attempting to learn how to use Frida to instrument android app, just for person interest. So far I've managed to get my environment set up with a physical android tablet and I can successfully ...
2
votes
1answer
189 views

LastPass Android javascript behaviour

A few weeks ago I made a proof-of-concept app demonstrating how LastPass' method of filling out creds in Chrome was insecure. For those interested the source is at https://github.com/activems/...
2
votes
1answer
62 views

automatically find the object “this” refers to in js

Im quite new to javascript and sometimes I find it really hard to find what object a keyword 'this' refers to. Is there a code editor that is able to do that for me? Or any other advice that could ...
2
votes
0answers
94 views

Where to start with reversing a custom JavaScript VM?

I have recently ran into the most heavy JavaScript obfuscation I've seen. It is using a custom VM to execute bytecodes. I have never dealt with such obfuscation, and I am wondering where I can start ...
2
votes
0answers
244 views

How to get video file URL from Twitter

I am looking how to find the video URL of a Twitter video so I can code a converter later (using nodejs or something), but I can't figure out how to do this. I saw this but it doesn't really clear ...
2
votes
1answer
702 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
2
votes
0answers
193 views

Javascript equivalent of JEB

In case you already know, there is a full-feature decompiler for Java/Android called JEB (https://www.pnfsoftware.com/) Some of the most important features include the ability to rename identifiers ...
2
votes
0answers
920 views

How to analyse the communication between a WebApp loaded with awesomium and the native program?

I have a Windows program that uses awesomium to display a WebApp. This WebApp communicates in some way with the client program through some native calls. I found references to window.externalHost and ...
1
vote
2answers
343 views

reverse javascript crackme encryption method algorithm

This crackme contains a text input element on the screen and a button to validate The value you enter is set into _inputValue, afterwards you click on a button, the function executes, in the last ...
1
vote
1answer
241 views

Is it possible to completely reverse this code?

i have this code i'm trying to deobfuscate https://pastebin.com/g5mHpWE4 I used https://beautifier.io/ and http://www.jsnice.org/ but the result is still not good, current code: https://pastebin.com/...
1
vote
1answer
4k views

Is deobfuscation of my javascript code hard or easy?

I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible. I have written a very small piece of ...
1
vote
1answer
123 views

Any good places to learn about JS de-obfuscation?

I am trying to make a bot on a specific website, so I have to reverse a lot of JS scripts. The reversing it self is not that hard but the de-obfuscation is. Lots of the scripts are obfuscated with ...
1
vote
1answer
86 views

What's wrong with my mitm to support rr commands with gdbserver on IDA?

First of here is the gdb remote protocol doc. The idea of the below script is the following - you enter an actual command (one that will be send as a direct packet see packets) in the gdb window then ...
1
vote
1answer
254 views

WebSocket debugging in Javascript app gives “401 Unauthorized” [closed]

I'm attempting to reverse engineer a private API used by an Android app that makes use of WebSockets. These requests are made from JavaScript inside a WebView. I use Charles to intercept both HTTP ...
1
vote
1answer
843 views

How do you un-obfuscate JS code that is evaluating your browser environment?

Given this: <script>var _0x4c36=['w6rChcKeWsKXw7TCocOlNF8Kw7bCuMKdKsOWTMKjF2A=','V3PClhXDu8OCCMO5WwbCp8KhD8KVw7LDo8KOwr7CiA==','w6saBzVaIwbDk8OqHMKGwpvDgzzCixMTMMOL','...
1
vote
1answer
320 views

deobfuscating javascript injected into Wordpress

Found a WP site (not mine) with lovely obfuscated code injected into the footer so I've been trying to de-obfuscate it. I ran it through unpacker, then converted hex to ASCII, then un-minified to ...
1
vote
1answer
159 views

Likely malicous Javascript-interested in how it works

Got this interesting bit of code compressed in an email named "Install-MSOffice365-WebView-Plugin-Update-0.165.11a.exe.js" that is undoubtedly malicous, but was curious what it does and am not much of ...
1
vote
0answers
6 views

'… Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript

I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error Unable to get property 'Debugger' of undefined or null reference. Line was simply var ctl = host....
1
vote
0answers
47 views

How does one go about reverse-engineering obfuscated/minified JavaScript in a browser like you would code in an IDE?

I am trying to figure out how some minified and possible highly-obfuscated JavaScript works. There are thousands of lines spanning multiple JS files. I have had a lot of success debugging it in my ...
1
vote
0answers
111 views

Intercepting packets from Electron App to keyboard in Linux

I have a USB keyboard which has an Electron app to set the macros on the keyboard. I unpacked the app.asar file, and the JS files seem to indicate that it is a ReactJS app, and is a minified ...
1
vote
0answers
61 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
1
vote
0answers
188 views

How to modify JS with mitmproxy?

I am trying to reverse engineer a heavily obfuscated web application, and I would like to modify the JS to add logging. So far, I've set up mitmproxy, but I can't figure out what the best way to edit ...
1
vote
0answers
148 views

How to hook eval function in node.js

As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me ...
1
vote
0answers
54 views

Need help reversing .m4t TTML subtitles format

I am currently trying to create subtitles for some proprietary Sony software. Unfortunatly, it only recognizes Sony's own .m4t subtitles format. After some research I found that this subtitles is also ...
1
vote
0answers
21 views

How to programmatically add HTML DOM breakpoints in chromium?

I've seen from this post about Chromium DevTools that there exists the possibility to add DOM breakpoints. Given that I've a full range of elements to monitor I was trying to find a way to ...
1
vote
0answers
120 views

deobfuscating/decompiling extremely complicated javascript [closed]

I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="...
1
vote
1answer
2k views

Analyzing and deobfuscating complex JS code [duplicate]

I am looking to reverse engineer a very ugly piece of JS found here. As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it ...
1
vote
2answers
128 views

How can a Javascript file drop .exe written in Visual Basic without network communication?

I am analyzing a malicious JS file, which is obfuscated in a way that I could not de-obfuscate. When I executed it in a virtual machine and spectated process changes, I noticed that a new executable ...
1
vote
0answers
66 views

Movies Anywhere ID?

I'm looking to automate requesting movies from different retailers on Movies Anywhere. The URL for the request is: https://retailer.moviesanywhere.com/api/purchase/initiate?retailer={retailer}&id={...
1
vote
1answer
633 views

Map an obfuscated javascript file to the original

Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...