首页 » js » 仅用[]()+!等符号就足以实现几乎任意Javascript代码

仅用[]()+!等符号就足以实现几乎任意Javascript代码

 

请在Firefox下测试

看了下例子:
js代码
<script>
alert("hi there")
</script>
就等价于
<script>
([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]])([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+(!![]+[])[+[]]+[][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])
</scirpt>

它实现的原理,有一个码表

复制代码代码如下:
(NaN+[]["filter"])[11]',
! window["atob"]("If")[0]',
" ("").fontcolor()[12]',
# window["atob"]("0iN")[1]',
$ window["atob"]("0iT")[1]',
% window["atob"]("0iW")[1]',
& window["atob"]("0ia")[1]',
' window["atob"]("0if")[1]',
( (false+[]["filter"])[20]',
) (false+[]["filter"])[21]',
* window["atob"]("0ir")[1]',
+ window["atob"]("0it")[1]',
, window["atob"]("0iy")[1]',
- (NaN+window["Date"]())[31]',
. window["atob"]("1i4")[1]',
/ (true+("")["sub"]())[10]',
0-9 ignored*/ ,,,,,,,,,,
: window["Date"]()[21]',
; window["atob"]("O0")[0]',
< ("")["sub"]()[0]',
= ("").fontcolor()[11]',
> ("")["sub"]()[10]',
? window["atob"]("0j9")[1]',
@ window["atob"]("00A")[1]',
A (+[]+[]["constructor"])[10]',
B (+[]+(false)["constructor"])[10]',
C window["atob"]("00N")[1]',
D window["btoa"](00)[1]',
E window["btoa"](01)[2]',
F (0+[]["filter"]["constructor"])[10]',
G window["btoa"]("0f")[1]',
H window["btoa"]("0t")[1]',
I ("Infinity")[0]',
J window["atob"]("00r")[1]',
K window["btoa"]("(")[0]',
L window["btoa"]("/")[0]',
M window["btoa"](0)[0]',
N ("NaN")[0]',
O window["btoa"](8)[0]',
P window["btoa"]("<")[0]',
Q window["btoa"]("a")[1]',
R window["atob"]("01I")[1]',
S window["btoa"]("I")[0]',
T window["btoa"]("N")[0]',
U window["atob"]("01W")[1]',
V window["atob"]("01a")[1]',
W (true+window)[12]',
X window["atob"]("01i")[1]',
Y window["btoa"]("a")[0]',
Z window["btoa"]("f")[0]',
[ (undefined+[]["filter"])[33]',
\ window["atob"]("01y")[1]',
] (true+[]["filter"])[40]',
^ window["atob"](014)[1]',
_ window["atob"](018)[1]',
window["atob"]("02A")[1]', <br /> a ("false")[1]', <br /> b (window+[])[2]', <br /> c ([]["filter"]+[])[3]', <br /> d ("undefined")[2]', <br /> e ("true")[3]', <br /> f ("false")[0]', <br /> g ([]+("")["constructor"])[14]', <br /> h window["atob"]("aN")[0]', <br /> i ([false]+undefined)[10]', <br /> j (window+[])[3]', <br /> k window["atob"]("a0")[0]', <br /> l ("false")[2]', <br /> m (Number+[])[11]', <br /> n ("undefined")[1]', <br /> o (true+[]["filter"])[10]', <br /> p window["atob"]("cN")[0]', <br /> q window["atob"]("cf")[0]', <br /> r ("true")[1]', <br /> s ("false")[3]', <br /> t ("true")[0]', <br /> u ("undefined")[0]', <br /> v (0+[]["filter"])[30]', <br /> w ([]["sort"]["call"]()+[])[13]', <br /> x window["atob"]("eN")[0]', <br /> y (NaN+[Infinity])[10]', <br /> z window["atob"]("et")[0]', <br /> { (NaN+[]["filter"])[21]', <br /> | window["atob"]("03y")[1]', <br /> } (NaN+[]["filter"])[41]', <br /> ~ window["atob"](234)[1]' </div> <p><br /> 拼接出来字符串 "eval",如何把 "eval" 变成 eval() 呢?方法是 <br /> []["sort"]["call"]()["eval"] <br /> 其中 []["sort"]["call"]() 等于 [].sort.call() ,等价于 window,所以上面 []["sort"]["call"]()["eval"] 就等价于 window.eval。 <br /> 然后就是体力活了,把码表对应转换成 eval("blah blah") 这种形式就可以执行任意代码了 <br /> 不同浏览器的码表不一样。Chrome和Firefox的index就不一样。 <br /> 其实这个码表还可以通过 ·toLocal*() 函数族扩展到Unicode,比fromCharCode要简短
原文:http://discogscounter.getfreehosting.co.uk/js-noalnum.php?txt=alert%28%22hi+there%22%29

原文链接:仅用[]()+!等符号就足以实现几乎任意Javascript代码,转载请注明来源!

0