Comments on: Javascript vbscript challenge

By: Giorgio Maone

Giorgio Maone — Mon, 10 Nov 2008 18:37:28 +0000

Will this one pass through SpamBam?
‘\
MsgBox 1′

Gareth Heyes — Mon, 10 Nov 2008 16:47:46 +0000

Ah-ha sorry again, that is a correct answer

Giorgio Maone — Mon, 10 Nov 2008 16:28:57 +0000

OK, I tried to unescape my code above: your *ckying SpamBam elided the JS c-style comments once more, even if they were url-escaped

Giorgio Maone — Mon, 10 Nov 2008 16:25:54 +0000

Gareth, did you decode it correctly?
Here’s the code above live, tested in IE8 both in standard and compatibility mode:
http://evil.hackademix.net/test/vbjs.html

Gareth Heyes — Mon, 10 Nov 2008 14:54:53 +0000

Hmmmm tried it in IE7 and it causes syntax errors. Close but not correct.

Gareth Heyes — Mon, 10 Nov 2008 10:11:03 +0000

Sorry Giorgio my bad commenting in my blog, nice one! It was a sub challenge hehe

Giorgio Maone — Mon, 10 Nov 2008 01:04:52 +0000

OK,
unescape(
“%27%27%0AMsgBox%201%27″
)

Giorgio Maone — Mon, 10 Nov 2008 01:00:53 +0000

Any way to preserve formatting and JS comments? Let’s try this way…



”

MsgBox 1′

Giorgio Maone — Mon, 10 Nov 2008 00:59:48 +0000

”
MsgBox 1′