Jump to content

JSFuck

From Wikipedia, the free encyclopedia

JSFuck is an esoteric subset of JavaScript, where code is written using only six characters: [, ], (, ), !, and +. The name is derived from Brainfuck, an esoteric programming language that also uses a minimalistic alphabet of only punctuation. Unlike Brainfuck, which requires its own compiler or interpreter, JSFuck is valid JavaScript code, meaning that JSFuck programs can be run in any web browser or engine that interprets JavaScript. JSFuck is able to recreate all JavaScript functionality using such a limited set of characters because JavaScript allows the evaluation of any expression as any type.[1]

History

[edit]

In July 2009, Yosuke Hasegawa created a web application called jjencode which could encode arbitrary JavaScript into an obfuscated form utilizing only the 18 symbols []()!+,\"$.:;_{}~=.[2][3] In January 2010, an informal competition was held in the "Obfuscation" forum of the sla.ckers.org web application security site to come up with a way to get the minimum number of characters required down to less than eight: []()!+,/. Contributors to the thread managed to eliminate the need for the , and / characters.[4] As of March 2010, an online encoder called JS-NoAlnum was available which utilized only the final set of six characters.[5] By the end of 2010, Hasegawa made a new encoder available named JSF*ck which also used only the minimum six characters.[6][7] In 2012, Martin Kleppe created a "jsfuck" project on GitHub,[8] and a JSFuck.com website with a web app using that implementation of the encoder.[9]

JSFuck can be used to bypass detection of malicious code submitted on websites, e.g. in cross-site scripting (XSS) attacks.[10] Another potential use of JSFuck lies in code obfuscation. An optimized version of JSFuck has been used to encode jQuery, a JavaScript library, into a fully functional version written with just the six characters.[11]

Encoding methods

[edit]

JSFuck code is extremely "verbose": In JavaScript, the code alert("Hello World!"), which causes a pop-up window to open with the text "Hello world", is 21 characters long. In JSFuck, the same code has a length of 4325 characters.[12] Certain single characters require far more than 1000 characters when expanded as JSFuck. This section offers an overview of how this expansion works.

Numbers

[edit]

The number 0 is created by +[], where [] is the empty array and + is the unary plus, used to convert the right side to a numeric value (zero here). The number 1 is formed as +!![] or +!+[], where the boolean value true (expressed as !![] or !+[] in JSFuck) is converted into the numeric value 1 by the prepended plus sign. The digits 2 to 9 are formed by summing true the appropriate number of times. E.g. in JavaScript true + true = 2 and true = !![] = !+[], hence 2 can be written as !![]+!![] or !+[]+!+[]. Other digits follow a similar pattern. Integers consisting of two or more digits are written, as a string, by concatenating 1-digit arrays with the plus operator. For example, the string "10" can be expressed in JavaScript as [1] + [0]. By replacing the digits with the respective JSFuck expansions, this yields [+!+[]]+[+[]]. To get a numeric value instead of a string, one would enclose the previous expression in parentheses or square brackets and prepend a plus, yielding 10 = +([+!+[]]+[+[]]).

Letters

[edit]

Some letters can be obtained in JSFuck by accessing single characters in the string representations of simple boolean or numeric values like "false", "true", "NaN", "undefined" with an indexer (a number in square brackets). Other tricks are needed to produce other letters – for example by casting the string 1e1000 into a number, which gives Infinity, which in turn makes the letter y accessible.[13]

The following is a list of primitive values used as building blocks to produce the most simple letters.

Value JSFuck
false ![]
true !![] or !+[]
NaN +[![]]
undefined [][[]]
Infinity +(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+[+!+[]]+[+[]]+[+[]]+[+[]])

Example: Creating the letter "a"

[edit]

"a": Taken from the string "false". The second character of "false" is a, which can be accessed with:

  1. "false"[1]. "false" can be made from false+[], i.e. the boolean constant false plus an empty array.
  2. (false+[])[1]: We write false as ![] (negation applied to an empty array).
  3. (![]+[])[1]: 1 is a number, we can write it as +true.
  4. (![]+[])[+true]: Since false is ![], true is !![].
  5. (![]+[])[+!![]] – which evaluates to "a".

Proof: In JavaScript, alert((![]+[])[+!![]]) does the same as alert("a").[14]

Other constructs

[edit]

The Function constructor can be used to trigger execution of JavaScript code contained in a string as if it were native JavaScript. So, for example, the statement alert(1) is equivalent to Function("alert(1)")(). The Function constructor can be retrieved in JSFuck by accessing the constructor property of a well known function, such as []["filter"] (Array.prototype.filter) or []["flat"] (Array.prototype.flat) in modern browsers. And then alert(1) becomes []["flat"]["constructor"]("alert(1)")().

Character table

[edit]

The characters with the shortest JSFuck expansions are listed below. Other UTF-8 characters can be expressed as well but will generate considerably longer code.

Character JSFuck
+ (+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+[+!+[]]+[+[]]+[+[]])+[])[!+[]+!+[]]
. (+(+!+[]+[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]])+[])[+!+[]]
0 +[]
1 +!![]
or +!+[]
2 !![]+!![]
or !+[]+!+[]
3 !![]+!![]+!![]
or !+[]+!+[]+!+[]
4 !![]+!![]+!![]+!![]
or !+[]+!+[]+!+[]+!+[]
5 !![]+!![]+!![]+!![]+!![]
or !+[]+!+[]+!+[]+!+[]+!+[]
6 !![]+!![]+!![]+!![]+!![]+!![]
or !+[]+!+[]+!+[]+!+[]+!+[]+!+[]
7 !![]+!![]+!![]+!![]+!![]+!![]+!![]
or !+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]
8 !![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]
or !+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]
9 !![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]
or !+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]
a (![]+[])[+!+[]]
c ([]+[][(![]+[])[+!![]]+(!![]+[])[+[]]])[!![]+!![]+!![]]
d ([][[]]+[])[!+[]+!+[]]
e (!![]+[])[!+[]+!+[]+!+[]]
f (![]+[])[+[]]
i ([![]]+[][[]])[+!+[]+[+[]]]
I (+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+(+!+[])+(+[])+(+[])+(+[]))+[])[+[]]
l (![]+[])[!+[]+!+[]]
N (+[![]]+[])[+[]]
n ([][[]]+[])[+!+[]]
o (!![]+[][(![]+[])[+!![]]+(!![]+[])[+[]]])[+!![]+[+[]]]
r (!+[]+[])[+!+[]]
s (![]+[])[!+[]+!+[]+!+[]]
t (!+[]+[])[+[]]
u ([][[]]+[])[+[]]
y (+[![]]+[+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+(+!+[])+(+[])+(+[])+(+[]))])[+!+[]+[+[]]]

Security

[edit]

Lacking the distinct features of "usual" JavaScript, obfuscation techniques like JSFuck can assist malicious JavaScript code in bypassing intrusion prevention systems[15] or content filters. For instance, the lack of alphanumeric characters in JSFuck and a flawed content filter allowed sellers to embed arbitrary JSFuck scripts in their eBay auction pages.[10]

See also

[edit]
  • Brainfuck - an esoteric programming language created in 1993 by Urban Müller.[16]

References

[edit]
  1. ^ Jane Bailey/The Daily WTF: "Bidding on Security". http://thedailywtf.com/articles/bidding-on-security
  2. ^ Hasegawa, Yosuke (2009-07-10). "jjencode - Encode any JavaScript program using only symbols". utf-8.jp. Archived from the original on 2009-07-15. Retrieved 2017-10-25.
  3. ^ Hasegawa, Yosuke (July 2009). "UTF-8.jp [2009-07-28]". utf-8.jp. Archived from the original on 2009-07-28. Retrieved 2017-10-25.
  4. ^ "Yet Another Useless Contest (but fun!) Less chars needed to run arbitrary JS code". sla.ckers.org. 2010-01-14. Archived from the original on 2011-03-01. Retrieved 2017-10-25.
  5. ^ "js-noalnum_com.php". discogscounter.getfreehosting.co.uk. Archived from the original on 2010-03-01. Retrieved 2017-10-25.
  6. ^ Aiko, Kenji (November 2010). "JSF*ck - []()!+". utf-8.jp. Archived from the original on 2010-12-01. Retrieved 2017-10-25.
  7. ^ Hasegawa, Yosuke (November 2010). "UTF-8.jp [2010-11-30]". utf-8.jp. Archived from the original on 2010-11-30. Retrieved 2017-10-25.
  8. ^ Kleppe, Martin (2012-07-16). "Commits · aemkei/jsfuck". github.com. Retrieved 2017-10-25.
  9. ^ Kleppe, Martin (September 2012). "Site report for www.jsfuck.com". toolbar.netcraft.com. Retrieved 2017-10-25.
  10. ^ a b Dan Goodin (3 February 2016). "eBay has no plans to fix "severe" bug that allows malware distribution [Updated]". Ars Technica.
  11. ^ https://github.com/fasttime/jquery-screwed jQuery JavaScript library made of only six different characters: ! ( ) + [ ]
  12. ^ "JScrewIt". JScrewIt. Retrieved 13 June 2021.
  13. ^ http://patriciopalladino.com/blog/2012/08/09/non-alphanumeric-javascript.html "Brainfuck Beware: JavaScript is after you!"
  14. ^ Adapted from: https://esolangs.org/wiki/JSFuck
  15. ^ Ré Medina, Matías A. (2012-09). Bypassing WAFs with non-alphanumeric XSS. Retrieved from http://blog.infobytesec.com/2012/09/bypassing-wafs-with-non-alphanumeric-xss.html.
  16. ^ Easter, Brandee (2020-04-02). "Fully Human, Fully Machine: Rhetorics of Digital Disembodiment in Programming". Rhetoric Review. 39 (2): 202–215. doi:10.1080/07350198.2020.1727096. ISSN 0735-0198. S2CID 219665562.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=JSFuck&oldid=1239721528"