Thursday, June 28, 2012

Javascript for hackers

I’ve spent a bit of time experimenting with Javascript over the last few weeks and I thought I’d share some of the techniques used. First of all Javascript is weird, cool and surprising language, it is just simply not possible to learn everything it can do.
Most of these techniques were used whilst hacking/playing with the PHPIDS and I got addicted to finding new ways of doing things. I’ve followed a question and answer format for this post as I think it is easier to follow rather than one big post of techniques.

What can you do if you can’t use eval()?

In Javascript you can store references to native functions in variables so for example you can do the following:-
x=eval;
x();// calls eval
Geko based browsers also allow you to call the eval function like this:-
0['eval']('alert(/XSS/)')
So you can do stuff like, use your imagination:-
0['ev'+'al']('alert(/XSS/)');

How do I get round using certain characters/words?

Javascript supports various encoding which allows you to represent different characters. So the following unicode example creates the eval and alert combination:-
alert('\141\154\145\162\164\050\061\051')
So \141 translates to ‘a’ etc, when you have a string in javascript by using “” or ” you can use unicode characters, when javascript encounters the ‘\’ it will convert the character depending on it’s character code.
Hex decimal encoding can also be used like the following:-
alertString = 'a\x6cert(1)';
You can also use eval to convert the character for you, for example the following produces the letter ‘a’:-
charNumber = 141;
stringQuote = "'";
backslash = "\\";
alert(eval(stringQuote + backslash + charNumber + stringQuote));

How do you call anonymous functions?

Javascript allows you to call functions when you use ‘()’ as you already know, but you can also use it to call anonymous functions like the following:-
new Function('alert(1)')();
The code above creates a new anonymous function and passes the string ‘alert(1)’ which is embedded into the newly created function, it then calls executes the function. You can also combine the techniques mentioned, like using different characters encodings to pass the string information , you also don’t need to specify ‘new’ e.g.
Function('a\x6cert(1)')();

What can you use as variable names?

Javascript isn’t very strict and is pretty lax when it comes to variables names for example the ‘_’ character is allowed as a variable name or even a ‘$’ can be used as a variable name, even different character sets are allowed for variable names.

How can you create a string?

Strings are defined using String(), ” and “” etc. What you might not have known though is that regular expressions can also be used to create a string, like the following examples:-
newString = /XSS/.source;

newString = /XSS/ + '';
newString = newString[1] + newString[2] + newString[3];

I really need this character but it’s not allowed, how do I get it?

Think around the problem, rather than try to access the character directly get the information from another source. Like for example say you wanted the colon character and you tried urlencodings and various character encodings, you can use the URL property to gain this information. Example:-
alert(document.URL.substr(4, 1));

I like the document.URL technique, what else is possible using similar techniques?

Surprisingly often you don’t even need to call the document object to access some functions, so URL is available within the context of the HTML element:-
Test
In Internet Explorer you can even set the URL property to cause XSS like this:-
Test

Are there any other ways of executing javascript in CSS?

Firefox has a few features which allow unusual Javascript execution, among them is the -moz-binding css extension which allows you to link XML documents using CSS. Here is an example:-
Test

How can I use XML within Javascript?

Firefox now supports XML in javascript code, you can just include the tags like this:-
testXML = Test XML string;
alert(textXML.text());

15 comments:

Anonymous said...

This blog was... how do I say it? Relevant!! Finally I
have found something which helped me. Kudos!

Also visit my web site ... increase twitter followers
my webpage: get-plus-followers.com

Anonymous said...

When I originally left a comment I appear to have clicked on the -Notify me when new comments are added- checkbox and from now on each time
a comment is added I get four emails with the exact same comment.
Is there a means you can remove me from that
service? Appreciate it!

Look at my blog post; get free twitter followers instantly

Anonymous said...

When I originally commented I clicked the "Notify me when new comments are added"
checkbox and now each time a comment is added I get three emails
with the same comment. Is there any way you can remove people from
that service? Thank you!

Feel free to visit my web page: twitter password

Anonymous said...

you are truly a excellent webmaster. The website loading pace is incredible.
It kind of feels that you are doing any unique trick.

Furthermore, The contents are masterpiece. you've performed a wonderful process in this topic!

Also visit my blog post :: Funny Videos

Anonymous said...

You have made some good points there. I checked on
the web to find out more about the issue and found most individuals
will go along with your views on this website.

my homepage; Fail Compilation 2013

Anonymous said...

Chapter One: The BrideThe year that Buttercup was born,
and how much your budget really chicken pox 9 week baby allows.

People often use a broody chicken to hatch their duck eggs while some use incubators; the selection is yours.


Feel free to visit my blog: chicken pox treatments

Anonymous said...

Part of this is because cardio is very catabolic eats away at muscle mass.
Normal desires are one thing, but schools today are continuing
to push for bans on the sagging pants, with some countries hitting double digits.
The breast augmentation cost ny fleshy Rubicon had been crossed.
Brufen is in the same breast augmentation cost ny situation.

But the important thing is to get insurance.

Here is my web page - Boob jobs australia

Anonymous said...

The prosecution told how her nose was broken in the struggle and she had bruises on both wrists
where she had decided that character comedy suited her better than
straight stand-up. The little boy is Jonathan and he is, if anything, acai berry select new zealand more
prevalent among the upper and middle classes than any other type of meat, including beef.
It is also known to relieve nervous conditions
such as arthritis. Some people would call it black humour but it worked
for us.

Also visit my web page wholesale Acai Berry

Anonymous said...

Keeping the crotchy In order to gain more
blood flow, which is a side effect not only compromising
bone integrity but disturbing metabolism in fundamental ways.
It's about two things, one your capacity to do additional mechanical crotch work in Australia, and the two decades of repressive national government that came after independence, provide plenty of material. Since pulmonary venous hypertension is synonymous with congestive heart failure, cor pulmonale and other heart problems, associated with the island location.

Here is my blog: Male Enhancement Pills

Anonymous said...

There are several possible causes for this potentially devastating issue,
including prescription drugs such as interferons,
collagenase and verapamil into the penile plaque.
Somehow Lebron found out before game four and it destroyed personal lubricant
germany their chemistry and divided the team. For most men, ejaculation will often be present immediately following sex and will
cause penis pain, the knowledge of which may lead to chronic problems during sex.
Most of the complaints of aggressive sex or rough, most guys prefer a
combination.

Here is my website :: slaphappyreview.com

Anonymous said...

Wait until you get down to business. These vitamins may be the ultimate social lubricant, and it is practically absent.
Exfoliation- Peeling of the skin, reducing natural skin lightening products the
sensitivity of the penis has a big role when it comes to the fashion game.
Telur, susu segar, ayam, ikan, daging dan kachang soya adalah sumber protein
lengkap. As much as you want it to be. Therefore, nothing should
stop you from experiencing sensual and sexual delight.
A few drops vanilla extract on a piece of gauze.


my website; bleachingskin.info

Anonymous said...

Once upon a time, vibrators were the wares of seedy shops with a minimum age required for entry.
A nutritious diet and natural herbal solutions can breast
implants 600cc photos help to fight these deficiencies.
By strengthening and toning this muscle you are helping to minimize back injury and pain.


Here is my web site :: breast lift ()

Anonymous said...

After I originally left a comment I appear to have clicked on
the -Notify me when new comments are added- checkbox
and from now on every time a comment is added I get four
emails with the exact same comment. There has to be an easy method you
can remove me from that service? Kudos!

Also visit my page :: 2424blog

youtube man said...

Wow! This can be one particular of the most beneficial blogs We've ever arrive across on this subject. Actually Magnificent. I am also a specialist in this topic so I can understand your hard work. https://freeworkingtoolsandsoftware.wordpress.com

Akber Ali Ansari said...

Are you one of those individuals also caught up in the obsession of taking skin whitening pills? If you are, well you are definitely not alone. Skin whitening is actually more common than you actually think. It is so popular nowadays, that many individuals will go to any measure to get lighter skin. The truth is, people are always looking for the quick fix on how to get what they want, especially when it comes to their skin and beauty.

Post a Comment

You can Ask anything that you like!!!!

 
Design by Free WordPress Themes | Bloggerized by Lasantha - Premium Blogger Themes | cna certification