Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to decode a JSFuck script?

I have this code in JavaScript:

[(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+
(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+
(!![]+[])[+!+[]]]

In the console, it will return

Array [ "filter" ]

And how can I decode a lot of text that’s similar to the text above? E.g.:

[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+
(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+
([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+
(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+
(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+
(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+
([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+
(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+
(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+
(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+
([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+
(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]

I want to see the plain script.

like image 471
Szymon Marczak Avatar asked Aug 06 '15 17:08

Szymon Marczak


3 Answers

I have seen many decoding attempts around, but none that work reliably. The easiest way I have found to decode Non Alphanumeric Javascript is with Chrome.

Open Chrome > Go to jsfuck.com > paste the code you would like to decode in the window > hit Run This.

Then open the Console, in the case of your specific code from PasteBin there will be an error:

Uncaught TypeError: Cannot read property 'innerHTML' of null  

To the right of the error, click the line number link, and the code will be revealed. The result is:

(function(){
    window.false=document.getElementById('sc').innerHTML;
})

Which explains why you get the error trying to just decode it using JSFuck itself. There is no element with the id sc on their site.

like image 110
Madness Avatar answered Nov 12 '22 18:11

Madness


You can use this website to decode jsfuck: http://codertab.com/jsunfuck

UPDATED I extracted the decode javascript from the URL above, this is how the decode process work: (javascript)

s = source.slice(0, source.length - 2); txtResult = eval(s);

Hope it help!

like image 23
Tubekeeper Avatar answered Nov 12 '22 19:11

Tubekeeper


    let elem = yourJSFuck
function decode(elem) {
    return (/\n(.+)/.exec(eval(elem.replace(/\s+/, "").slice(0, -2)))[1]);
}

console.log(decode(elem))

This should work, the source is from this page

like image 2
Християн Христов Avatar answered Nov 12 '22 17:11

Християн Христов