JSReg has grown up a bit since I released the first version. You can now use it to monitor malicious javascript. I have a very basic example of this in Hackvertor, at the moment Hackvertor doesn’t support callbacks so it’s a bit of a hack but you will get the idea. I use __defineSetter__ to […]

I thought I’d post a quick tutorial on how Hackvertor can be used to decode obfuscated javascript. This is based on a real request on sla.ckers. I’ll walk you through the code and tidy it up and show you how to use the advanced tags to easily decode the encoded string. Warning disclaimer Do not […]

Whilst reading everyone’s tweets, I found Yosuke Hasegawa had posted a binary string. I decoded it out of curiosity, first it was binary, then character codes, then UTF-7 and finally Japanese. So yeah you can tell what’s coming, I wanted Hackvertor to decode it all for me. Here’s the string:- 00101011 01001101 01000111 00111000 01110111 […]

I posted a vector to the web app sec list because they were discussing expression XSS. Ivan Ristic naturally used Hackvertor to try and decode the vector automatically. But he exposed a bug in the auto decoder. Well it’s now fixed yay! Thanks Ivan. I found a couple of errors in my reg exp syntax […]

I’ve finally created a Hackvertor video demo, I’ve encoded it in swf and compressed it quite a lot. The quality is good and at a high resolution but the colours are a bit out other than that it should be quite clear how it works. The demo is available here:- Hackvertor video demo

I’ve been busy investigating URLs recently and I thought my Hackvertor tool had all ways of changing a IP covered. But after researching stuff over the weekend I found that it is lacking in certain areas. For example you can convert two octets to octal or hex and there wasn’t really a easy way of […]

Update I’ve updated Hackvertor for the final time until the brand new version is ready. I thought I’d blog about it because it includes some interesting features from a security point of view. HTML escape The DOM inspector didn’t escape HTML when inspecting the DOM, this didn’t cause XSS because user interaction was need to […]

I’ve been busy lately so I’ve not had time to post much but while writing yet another fuzzer I added a new tag to Hackvertor. Basically I write this code a million times and adding to Hackvertor enables me to save time and conveniently convert strings to arrays. The tag supports both Javascript and PHP […]

A user of Hackvertor contacted me and suggested a mailing list to collect ideas and feature requests. I must admit that because of time I haven’t had the opportunity to ask users they thought. I guess I also assumed that there wouldn’t be many people using the tool but it turns out there are one […]

Finding a pattern in malicious javascript is difficult, it’s possible to selectively change the source code yet still execute the same payload. There are many ways to morph Javascript and I shall go through a few of the possibilities and provide examples through Hackvertor (which now supports code morphing). In order for a pattern to […]