仅用[]()+!等符号就足以实现几乎任意Javascript代码 |
本文标签:符号,Javascript代码 请在Firefox下测试 看了下例子: js代码 <script> alert("hi there") </script> 就等价于 <script> ([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]])([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+(!![]+[])[+[]]+[][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]) </scirpt> 它实现的原理,有一个码表 复制代码 代码如下: (NaN+[]["filter"])[11], ! window["atob"]("If")[0], " ("").fontcolor()[12], # window["atob"]("0iN")[1], $ window["atob"]("0iT")[1], % window["atob"]("0iW")[1], & window["atob"]("0ia")[1], window["atob"]("0if")[1], ( (false+[]["filter"])[20], ) (false+[]["filter"])[21], * window["atob"]("0ir")[1], + window["atob"]("0it")[1], , window["atob"]("0iy")[1], - (NaN+window["Date"]())[31], . window["atob"]("1i4")[1], / (true+("")["sub"]())[10], 0-9 ignored*/ ,,,,,,,,,, : window["Date"]()[21], ; window["atob"]("O0")[0], < ("")["sub"]()[0], = ("").fontcolor()[11], > ("")["sub"]()[10], ? window["atob"]("0j9")[1], @ window["atob"]("00A")[1], A (+[]+[]["constructor"])[10], B (+[]+(false)["constructor"])[10], C window["atob"]("00N")[1], D window["btoa"](00)[1], E window["btoa"](01)[2], F (0+[]["filter"]["constructor"])[10], G window["btoa"]("0f")[1], H window["btoa"]("0t")[1], I ("Infinity")[0], J window["atob"]("00r")[1], K window["btoa"]("(")[0], L window["btoa"]("/")[0], M window["btoa"](0)[0], N ("NaN")[0], O window["btoa"](8)[0], P window["btoa"]("<")[0], Q window["btoa"]("a")[1], R window["atob"]("01I")[1], S window["btoa"]("I")[0], T window["btoa"]("N")[0], U window["atob"]("01W")[1], V window["atob"]("01a")[1], W (true+window)[12], X window["atob"]("01i")[1], Y window["btoa"]("a")[0], Z window["btoa"]("f")[0], [ (undefined+[]["filter"])[33], \ window["atob"]("01y")[1], ] (true+[]["filter"])[40], ^ window["atob"](014)[1], _ window["atob"](018)[1], ` window["atob"]("02A")[1], a ("false")[1], b (window+[])[2], c ([]["filter"]+[])[3], d ("undefined")[2], e ("true")[3], f ("false")[0], g ([]+("")["constructor"])[14], h window["atob"]("aN")[0], i ([false]+undefined)[10], j (window+[])[3], k window["atob"]("a0")[0], l ("false")[2], m (Number+[])[11], n ("undefined")[1], o (true+[]["filter"])[10], p window["atob"]("cN")[0], q window["atob"]("cf")[0], r ("true")[1], s ("false")[3], t ("true")[0], u ("undefined")[0], v (0+[]["filter"])[30], w ([]["sort"]["call"]()+[])[13], x window["atob"]("eN")[0], y (NaN+[Infinity])[10], z window["atob"]("et")[0], { (NaN+[]["filter"])[21], | window["atob"]("03y")[1], } (NaN+[]["filter"])[41], ' window["atob"](234)[1] 拼接出来字符串 "eval",如何把 "eval" 变成 eval() 呢?方法是 []["sort"]["call"]()["eval"] 其中 []["sort"]["call"]() 等于 [].sort.call() ,等价于 window,所以上面 []["sort"]["call"]()["eval"] 就等价于 window.eval 。 然后就是体力活了,把码表对应转换成 eval("blah blah") 这种形式就可以执行任意代码了 不同浏览器的码表不一样 。Chrome和Firefox的index就不一样 。 其实这个码表还可以通过 ·toLocal*()` 函数族扩展到Unicode,比fromCharCode要简短 原文:http://discogscounter.getfreehosting.co.uk/js-noalnum.php?txt=alert%28%22hi+there%22%29 |