僅用 []()+! 就足以實現幾乎任意Javascript代碼

來源:互聯網
上載者:User

G Reader裡Dexter同學的分享,來自sla.ckers.org的又一神作

點我測試

GReader裡看不到效果的同學請自行測試下列HTML:

<script language="javascript" type="text/javascript">
([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]])([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+(!![]+[])[+[]]+[][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])
</script>

線上轉換工具

跟Brainfuck有的一拼。。。是掛馬的好辦法。。。

更新:研究了一下它實現的原理,有一個碼錶:

    (NaN+[]["filter"])[11]',
! window["atob"]("If")[0]',
" ("").fontcolor()[12]',
# window["atob"]("0iN")[1]',
$ window["atob"]("0iT")[1]',
% window["atob"]("0iW")[1]',
& window["atob"]("0ia")[1]',
' window["atob"]("0if")[1]',
( (false+[]["filter"])[20]',
) (false+[]["filter"])[21]',
* window["atob"]("0ir")[1]',
+ window["atob"]("0it")[1]',
, window["atob"]("0iy")[1]',
- (NaN+window["Date"]())[31]',
. window["atob"]("1i4")[1]',
/ (true+("")["sub"]())[10]',
0-9 ignored*/ ,,,,,,,,,,
: window["Date"]()[21]',
; window["atob"]("O0")[0]',
< ("")["sub"]()[0]',
= ("").fontcolor()[11]',
> ("")["sub"]()[10]',
? window["atob"]("0j9")[1]',
@ window["atob"]("00A")[1]',
A (+[]+[]["constructor"])[10]',
B (+[]+(false)["constructor"])[10]',
C window["atob"]("00N")[1]',
D window["btoa"](00)[1]',
E window["btoa"](01)[2]',
F (0+[]["filter"]["constructor"])[10]',
G window["btoa"]("0f")[1]',
H window["btoa"]("0t")[1]',
I ("Infinity")[0]',
J window["atob"]("00r")[1]',
K window["btoa"]("(")[0]',
L window["btoa"]("/")[0]',
M window["btoa"](0)[0]',
N ("NaN")[0]',
O window["btoa"](8)[0]',
P window["btoa"]("<")[0]',
Q window["btoa"]("a")[1]',
R window["atob"]("01I")[1]',
S window["btoa"]("I")[0]',
T window["btoa"]("N")[0]',
U window["atob"]("01W")[1]',
V window["atob"]("01a")[1]',
W (true+window)[12]',
X window["atob"]("01i")[1]',
Y window["btoa"]("a")[0]',
Z window["btoa"]("f")[0]',
[ (undefined+[]["filter"])[33]',
\ window["atob"]("01y")[1]',
] (true+[]["filter"])[40]',
^ window["atob"](014)[1]',
_ window["atob"](018)[1]',
` window["atob"]("02A")[1]',
a ("false")[1]',
b (window+[])[2]',
c ([]["filter"]+[])[3]',
d ("undefined")[2]',
e ("true")[3]',
f ("false")[0]',
g ([]+("")["constructor"])[14]',
h window["atob"]("aN")[0]',
i ([false]+undefined)[10]',
j (window+[])[3]',
k window["atob"]("a0")[0]',
l ("false")[2]',
m (Number+[])[11]',
n ("undefined")[1]',
o (true+[]["filter"])[10]',
p window["atob"]("cN")[0]',
q window["atob"]("cf")[0]',
r ("true")[1]',
s ("false")[3]',
t ("true")[0]',
u ("undefined")[0]',
v (0+[]["filter"])[30]',
w ([]["sort"]["call"]()+[])[13]',
x window["atob"]("eN")[0]',
y (NaN+[Infinity])[10]',
z window["atob"]("et")[0]',
{ (NaN+[]["filter"])[21]',
| window["atob"]("03y")[1]',
} (NaN+[]["filter"])[41]',
~ window["atob"](234)[1]'

拼接出來字串 "eval",如何把 "eval" 變成 eval() 呢?方法是

[]["sort"]["call"]()["eval"]

其中 []["sort"]["call"]() 等於 [].sort.call() ,等價於 window,所以上面 []["sort"]["call"]()["eval"] 就等價於 window.eval

然後就是體力活了,把碼錶對應轉換成 eval("blah blah") 這種形式就可以執行任意代碼了

不同瀏覽器的碼錶不一樣。 Chrome和Firefox的index就不一樣。

其實這個碼錶還可以通過 ·toLocal*()` 函數族擴充到Unicode,比fromCharCode要簡短

相關文章

聯繫我們

該頁面正文內容均來源於網絡整理,並不代表阿里雲官方的觀點,該頁面所提到的產品和服務也與阿里云無關,如果該頁面內容對您造成了困擾,歡迎寫郵件給我們,收到郵件我們將在5個工作日內處理。

如果您發現本社區中有涉嫌抄襲的內容,歡迎發送郵件至: info-contact@alibabacloud.com 進行舉報並提供相關證據,工作人員會在 5 個工作天內聯絡您,一經查實,本站將立刻刪除涉嫌侵權內容。

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.