StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>One idea is to <strong>use websockets</strong> to serve javascript files to the browser through a <code>socket.listener</code> and running with <code>eval</code>. That way, it's very very very difficult for anyone to see the actual "source", since the connection of the socket has been already closed.</p> <p>There is another amazing tactic which can be seen on the homepage of <a href="http://samy.pl" rel="nofollow">http://samy.pl</a>, <strong>which uses spaces (\u0020) and tabs (\u0009) as a byte cipher to hide JS code!</strong></p> <p>If you view the source, you can only see 1 line of actual JS code: <a href="http://pastebin.com/e0pqJ8sB" rel="nofollow">http://pastebin.com/e0pqJ8sB</a> See for yourself if you can figure out how it works (no spoilers!)</p> <p>As far as obfuscators go, see <a href="http://utf-8.jp/public/jjencode.html" rel="nofollow">http://utf-8.jp/public/jjencode.html</a> (and/or another version)</p> <p>This free obfuscator <strong>runs client-side</strong>, and produces gibberish that <code>unminify.com</code> and <code>jsbeautifier</code> can't even decode:</p> <pre><code>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"(\\\"\\"+$.__$+$.__$+$.___+$.$$$_+(![]+"")[$._$_]+(![]+"")[$._$_]+$._$+",\\"+$.$__+$.___+"\\"+$.__$+$.__$+$._$_+$.$_$_+"\\"+$.__$+$.$$_+$.$$_+$.$_$_+"\\"+$.__$+$._$_+$._$$+$.$$__+"\\"+$.__$+$.$$_+$._$_+"\\"+$.__$+$.$_$+$.__$+"\\"+$.__$+$.$$_+$.___+$.__+"\\\"\\"+$.$__+$.___+")"+"\"")())(); </code></pre> <p>Original code:</p> <pre><code>alert("Hello, JavaScript") </code></pre> <p>Output from both beautifier websites:</p> <pre><code>$ = ~[]; $ = { ___: ++$, $$$$: (![] + "")[$], __$: ++$, $_$_: (![] + "")[$], _$_: ++$, $_$$: ({} + "")[$], $$_$: ($[$] + "")[$], _$$: ++$, $$$_: (!"" + "")[$], $__: ++$, $_$: ++$, $$__: ({} + "")[$], $$_: ++$, $$$: ++$, $___: ++$, $__$: ++$ }; $.$_ = ($.$_ = $ + "")[$.$_$] + ($._$ = $.$_[$.__$]) + ($.$$ = ($.$ + "")[$.__$]) + ((!$) + "")[$._$$] + ($.__ = $.$_[$.$$_]) + ($.$ = (!"" + "")[$.__$]) + ($._ = (!"" + "")[$._$_]) + $.$_[$.$_$] + $.__ + $._$ + $.$; $.$$ = $.$ + (!"" + "")[$._$$] + $.__ + $._ + $.$ + $.$$; $.$ = ($.___)[$.$_][$.$_]; $.$($.$($.$$ + "\"" + $.$_$_ + (![] + "")[$._$_] + $.$$$_ + "\\" + $.__$ + $.$$_ + $._$_ + $.__ + "(\\\"\\" + $.__$ + $.__$ + $.___ + $.$$$_ + (![] + "")[$._$_] + (![] + "")[$._$_] + $._$ + ",\\" + $.$__ + $.___ + "\\" + $.__$ + $.__$ + $._$_ + $.$_$_ + "\\" + $.__$ + $.$$_ + $.$$_ + $.$_$_ + "\\" + $.__$ + $._$_ + $._$$ + $.$$__ + "\\" + $.__$ + $.$$_ + $._$_ + "\\" + $.__$ + $.$_$ + $.__$ + "\\" + $.__$ + $.$$_ + $.___ + $.__ + "\\\"\\" + $.$__ + $.___ + ")" + "\"")())(); </code></pre> <p>Hope this enlightens those in need!</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload