仅用[]()+!等符号就足以实现几乎任意Javascript代码


Posted in Javascript onMarch 01, 2010

请在Firefox下测试

看了下例子:
js代码
<script>
alert("hi there")
</script>
就等价于
<script>
([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]])([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+(!![]+[])[+[]]+[][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])
</scirpt>

它实现的原理,有一个码表

(NaN+[]["filter"])[11]', 
! window["atob"]("If")[0]', 
" ("").fontcolor()[12]', 
# window["atob"]("0iN")[1]', 
$ window["atob"]("0iT")[1]', 
% window["atob"]("0iW")[1]', 
& window["atob"]("0ia")[1]', 
' window["atob"]("0if")[1]', 
( (false+[]["filter"])[20]', 
) (false+[]["filter"])[21]', 
* window["atob"]("0ir")[1]', 
+ window["atob"]("0it")[1]', 
, window["atob"]("0iy")[1]', 
- (NaN+window["Date"]())[31]', 
. window["atob"]("1i4")[1]', 
/ (true+("")["sub"]())[10]', 
0-9 ignored*/ ,,,,,,,,,, 
: window["Date"]()[21]', 
; window["atob"]("O0")[0]', 
< ("")["sub"]()[0]', 
= ("").fontcolor()[11]', 
> ("")["sub"]()[10]', 
? window["atob"]("0j9")[1]', 
@ window["atob"]("00A")[1]', 
A (+[]+[]["constructor"])[10]', 
B (+[]+(false)["constructor"])[10]', 
C window["atob"]("00N")[1]', 
D window["btoa"](00)[1]', 
E window["btoa"](01)[2]', 
F (0+[]["filter"]["constructor"])[10]', 
G window["btoa"]("0f")[1]', 
H window["btoa"]("0t")[1]', 
I ("Infinity")[0]', 
J window["atob"]("00r")[1]', 
K window["btoa"]("(")[0]', 
L window["btoa"]("/")[0]', 
M window["btoa"](0)[0]', 
N ("NaN")[0]', 
O window["btoa"](8)[0]', 
P window["btoa"]("<")[0]', 
Q window["btoa"]("a")[1]', 
R window["atob"]("01I")[1]', 
S window["btoa"]("I")[0]', 
T window["btoa"]("N")[0]', 
U window["atob"]("01W")[1]', 
V window["atob"]("01a")[1]', 
W (true+window)[12]', 
X window["atob"]("01i")[1]', 
Y window["btoa"]("a")[0]', 
Z window["btoa"]("f")[0]', 
[ (undefined+[]["filter"])[33]', 
\ window["atob"]("01y")[1]', 
] (true+[]["filter"])[40]', 
^ window["atob"](014)[1]', 
_ window["atob"](018)[1]', 
` window["atob"]("02A")[1]', 
a ("false")[1]', 
b (window+[])[2]', 
c ([]["filter"]+[])[3]', 
d ("undefined")[2]', 
e ("true")[3]', 
f ("false")[0]', 
g ([]+("")["constructor"])[14]', 
h window["atob"]("aN")[0]', 
i ([false]+undefined)[10]', 
j (window+[])[3]', 
k window["atob"]("a0")[0]', 
l ("false")[2]', 
m (Number+[])[11]', 
n ("undefined")[1]', 
o (true+[]["filter"])[10]', 
p window["atob"]("cN")[0]', 
q window["atob"]("cf")[0]', 
r ("true")[1]', 
s ("false")[3]', 
t ("true")[0]', 
u ("undefined")[0]', 
v (0+[]["filter"])[30]', 
w ([]["sort"]["call"]()+[])[13]', 
x window["atob"]("eN")[0]', 
y (NaN+[Infinity])[10]', 
z window["atob"]("et")[0]', 
{ (NaN+[]["filter"])[21]', 
| window["atob"]("03y")[1]', 
} (NaN+[]["filter"])[41]', 
~ window["atob"](234)[1]'

拼接出来字符串 "eval",如何把 "eval" 变成 eval() 呢?方法是
[]["sort"]["call"]()["eval"]
其中 []["sort"]["call"]() 等于 [].sort.call() ,等价于 window,所以上面 []["sort"]["call"]()["eval"] 就等价于 window.eval。
然后就是体力活了,把码表对应转换成 eval("blah blah") 这种形式就可以执行任意代码了
不同浏览器的码表不一样。Chrome和Firefox的index就不一样。
其实这个码表还可以通过 ·toLocal*()` 函数族扩展到Unicode,比fromCharCode要简短
原文:http://discogscounter.getfreehosting.co.uk/js-noalnum.php?txt=alert%28%22hi+there%22%29
Javascript 相关文章推荐
Mootools 1.2教程 选项卡效果(Tabs)
Sep 15 Javascript
让IE8支持DOM 2(不用框架!)
Dec 31 Javascript
Javascript倒计时代码
Aug 12 Javascript
JS的数组迭代方法
Feb 05 Javascript
jQuery实现鼠标悬停显示提示信息窗口的方法
Apr 30 Javascript
利用Angularjs和bootstrap实现购物车功能
Aug 31 Javascript
Node连接mysql数据库方法介绍
Feb 07 Javascript
vue 数组和对象不能直接赋值情况和解决方法(推荐)
Oct 25 Javascript
基于vue中keep-alive缓存问题的解决方法
Sep 21 Javascript
微信小程序使用swiper组件实现层叠轮播图
Nov 04 Javascript
使用Vue调取接口,并渲染数据的示例代码
Oct 28 Javascript
JavaScript中Object、map、weakmap的区别分析
Dec 15 Javascript
Javascript 网页水印(非图片水印)实现代码
Mar 01 #Javascript
使用js获取QueryString的方法小结
Feb 28 #Javascript
JQuery 将元素显示在屏幕的中央的代码
Feb 27 #Javascript
jquery 最简单易用的表单验证插件
Feb 27 #Javascript
JQuery团队打造的javascript单元测试工具QUnit介绍
Feb 26 #Javascript
getElementsByTagName vs selectNodes效率 及兼容的selectNodes实现
Feb 26 #Javascript
JavaScript 空位补零实现代码
Feb 26 #Javascript
You might like
PHP 设计模式之观察者模式介绍
2012/02/22 PHP
深入PHP中的HashTable结构详解
2013/06/13 PHP
php中文验证码实现示例分享
2014/01/12 PHP
jquery 与NVelocity 产生冲突的解决方法
2011/06/13 Javascript
用javascript添加控件自定义属性解析
2013/11/25 Javascript
JS之Date对象和获取系统当前时间详解
2014/01/13 Javascript
jQuery处理json数据返回数组和输出的方法
2015/03/11 Javascript
jQuery动画效果图片轮播特效
2016/01/12 Javascript
jQuery实现table中的tr上下移动并保持序号不变的实例代码
2016/07/11 Javascript
Google 地图类型详解及示例代码
2016/08/06 Javascript
详细分析Javascript中创建对象的四种方式
2016/08/17 Javascript
JavaScript中数组Array方法详解
2017/02/27 Javascript
JavaScript中this的用法及this在不同应用场景的作用解析
2017/04/13 Javascript
JS去掉字符串末尾的标点符号及删除最后一个字符的方法
2017/10/24 Javascript
vue实现购物车的监听
2020/04/20 Javascript
vue 里面的 $forceUpdate() 强制实例重新渲染操作
2020/09/21 Javascript
简单分析Python中用fork()函数生成的子进程
2015/05/04 Python
python修改字典内key对应值的方法
2015/07/11 Python
pandas 数据实现行间计算的方法
2018/06/08 Python
详解Python3之数据指纹MD5校验与对比
2019/06/11 Python
Pycharm小白级简单使用教程
2020/01/08 Python
Python unittest单元测试openpyxl实现过程解析
2020/05/27 Python
德国旅行、体验和活动的预订平台:Watado
2019/12/04 全球购物
乌克兰机票、铁路和巴士票、酒店搜索、保险:Tickets.ua
2020/01/11 全球购物
俄罗斯鲜花递送:AMF
2020/04/24 全球购物
施工人员岗位职责
2013/12/12 职场文书
校园活动策划方案
2014/06/13 职场文书
迎七一演讲稿
2014/09/12 职场文书
2014国庆节演讲稿:祖国在我心中(400字)
2014/09/25 职场文书
2015年仓管员工作总结
2015/04/21 职场文书
硕士毕业答辩开场白
2015/05/27 职场文书
水浒传读书笔记
2015/06/25 职场文书
赞助商致辞
2015/07/30 职场文书
2016年第32个教师节致辞
2015/11/26 职场文书
2016教师校本研修心得体会
2016/01/08 职场文书
继承Win10缺点!教你关闭Win11烦人的网络搜索
2021/11/23 数码科技