Hacking Javascripts

advertisement

Allright, for all you peeps out there who are having trouble hacking your way through a simple javascblockedript, I wrote this simple but effective article.


Let's start with the following question: What happens when we enter our password into a javascblockedript? OR What actions performs the scblockedript to verify us?

The answer is simple: The scblockedript compares our input with a given value or variable.


Let us look a 3 different examples:

1) Comparing with a given value

function checkpass {
if (enteredpassword=="dapass") {
alert("You got it!")
}
else {
alert("Invalid UserID")
}
}

I suppose nobody has problems with this. The password you need to enter is dapass.


2) Comparing with a variable

function checkpass {
var pass = "dapass"

if (enteredpassword==pass) {
alert("You got it!")
}
else {
alert("Invalid UserID")
}
}

I think this is also a very simple scblockedript. You clearly see what value/variable the scblockedript is comparing your input to and what its value is.


3) Comparing with a variable but...

function checkpass {
var pass = "da"
var pass2 = "pass"
var pass3 = pass + pass2 //this line combines "da" and "pass" into "dapass"

if (enteredpassword==pass3) {
alert("You got it!")
}
else {
alert("Invalid UserID")
}
}

John Doe might think: "w00t this is too easy!" and yes this is an easy scblockedript but it's the concept that counts. What if you all sorts of calculations and functions that are editing the final variable. You could reconstruct everything but that will take a while, no? John Doe will possibly think: "I will just enter javascblockedript:alert(pass3) in my browser to pop up a window with the pass. OK... huh? Why is the box empty?"

A big hint to everyone: always try the scblockedript with some bibberish else some variables/actions won't yet be initialized/used. So no wonder JD gets an empty alertbox: the operation pass + pass2 in the pass3 variable was never excuted thus it doesn't contain any value!

After excuting the scblockedript with random values JD finds the pass with javascblockedript:alert(pass3) and he lives happely ever after...


NOTE 1: scblockedripts could not be in the page itself but in an external file. You can use the JSView extension for Firefox to easily find external javascblockedripts/css-files.

NOTE 2: the method described in 3 requires some logical thinking (*) and you will need to view the scblockedript itself to get the variable (duh!). (*) e.g. if the scblockedript says if (enteredpassword==pass) {...} don't start looking in the variable pass3 or anything ;)


Voila, I hope this article helped you and contained just what you were expecting. If you want to know or you're thinking: "Why isn't this or that discussed here?" Just leave a comment and I'll add it or simply write a v2 of my article ;)

The_Cell