JAVASCRIPT DEOBFUSCATION FOR PENTESTER.
Hi, My name is Hashar Mujahid, And today we are going to learn about what are JavaScript OBFUSCATION techniques and how we can deobfuscate it from a penetration testing point of view.
First of all, let’s discuss what code obfuscation is and why it is used.
WHAT IS CODE OBFUSCATION?
Code obfuscation is the practice of deliberately writing code in a way that makes it difficult to understand or read, with the aim of making it harder for someone to reverse-engineer or modify the code.
The process of obfuscation involves transforming code to make it less human-readable, such as renaming variables to shorter, less meaningful names or using different syntax constructions. This can also involve adding meaningless or redundant code to make the overall program structure more complex.
Obfuscation can be useful for protecting intellectual property and preventing unauthorized access to sensitive code. However, it can also make debugging and maintenance more difficult, and may negatively impact the performance of the code. It is important to weigh the benefits and drawbacks of obfuscation before deciding whether or not to use it.
There are many online tools that can help you obfuscate your code.
like JavascriptObfuscator.io.
Now Let’s discuss code obfuscation is javascript.
JAVASCRIPT CODE OBFUSCATION:
Javascript can be written internally in a html file or it can be written in a separate js file which will then be linked to our HTML page using script tags.
<script src="secret.js"></script>An obfuscated code in javascript looks something like this.
eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('1.0("2 3 5 4 6");',7,7,'log|console|This|is|simple|a|code'.split('|'),0,{}))We can see the code is very hard to read and make sense of.Let’s try to obfuscate a simple code.
function Test(){
console.log("This is a simple code");
}Let’s run this as it is and then run it after we obfuscate it.
Let’s now obfuscate this.
eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('1.0("2 3 5 4 6");',7,7,'log|console|This|is|simple|a|code'.split('|'),0,{}))
We can see the code output is the same as before but now it is much more difficult to understand.
Get Hashar Mujahid’s stories in your inbox
Join Medium for free to get updates from this writer.
There are other types of encoding like JSFUCK [Yes!! Not making this up].
JSFuck is a form of encoding that uses only six characters to represent all valid JavaScript code. The six characters used are:
(- open parentheses)- close parentheses!- exclamation mark[- open square bracket]- close square bracket+- plus sign
Here’s an example of how JSFuck can be used to encode the string “Hello, World!”:
([]+[])[+!+[]]+(![]+[])[+!+[]]+([][[]]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]]+([][(+!![])+(+!![])+(+!![])+(+!![])+(+!![])+(+!![])]+[])[!+[]+!+[]+!+[]]+([][(+!![])+(+!![])]+[])[+!+[]]+(!![]+[])[+[]]+([][(+!![])+(+!![])]+[])[!+[]+!+[]+!+[]]+([][(+!![])+(+!![])+(+!![])+(+!![])+(+!![])+(+!![])]+[])[+!+[]]+(!![]+[])[+!+[]]And JJencode
eval(function(p,a,c,k,e,d){while(c--)if(k[c])p=p.replace(new RegExp('\\b'+c.toString(a)+'\\b','g'),k[c]);return p;}('0(g){1.log("2, "+g+"!");}var 3=4(\'5 0(g){1.6("2, "+g+"!");}\');7.8(3);',9,9,'function|console|Hello|name|jjencode|function|log|eval|encoded'.split('|'),0,{}))and AAencode.
ﾆ荑ㄘﾊﾆ鉄乘ﾊﾀ焚笈ﾆﾊ畝鉄焚ﾆ鉄乘ﾊﾆ畝畝鉄乘焚ﾆﾊ焚ﾆ畝畝畝焚乘鉄畝焚乘ﾊﾆ畝鉄焚ﾆﾊ焚ﾆ畝畝畝ﾊNow Let’s discuss Deobfuscation Techniques.
BEAUTIFY AND DEOBFUSCATE JS CODE:
Sometimes we can see the code is written in one line like this.
eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('1.0("2 3 5 4 6");',7,7,'log|console|This|is|simple|a|code'.split('|'),0,{}))We can beautify this using some tools like Prettier or Beautifier. Let’s copy this code and beautify this using one og these tools.
We can see our code is beautified into readable format.
We can also use tools like JSNice.
We can use these tools to deobfuscate the javascript code and make It more readable.
Hope this helps you to learn more about js Obfuscation techniques.
I will see you all in the next blog till then! Happy HAcking ❤!
