Hacking Javascripts

Hacking Javascripts

By ghost | 9300 Reads |

0     0

Allright, for all you peeps out there who are having trouble hacking your way through a simple javascript, I wrote this simple but effective article.

Let's start with the following question: What happens when we enter our password into a javascript? OR What actions performs the script to verify us?

The answer is simple: The script compares our input with a given value or variable.

Let us look a 3 different examples:

1. Comparing with a given value

function checkpass { if (enteredpassword=="dapass") { alert("You got it!") } else { alert("Invalid UserID") } }

I suppose nobody has problems with this. The password you need to enter is dapass.

2. Comparing with a variable

function checkpass { var pass = "dapass"

if (enteredpassword==pass) { alert("You got it!") } else { alert("Invalid UserID") } }

I think this is also a very simple script. You clearly see what value/variable the script is comparing your input to and what its value is.

3. Comparing with a variable but…

function checkpass { var pass = "da" var pass2 = "pass" var pass3 = pass + pass2 //this line combines "da" and "pass" into "dapass"

if (enteredpassword==pass3) { alert("You got it!") } else { alert("Invalid UserID") } }

John Doe might think: "w00t this is too easy!" and yes this is an easy script but it's the concept that counts. What if you all sorts of calculations and functions that are editing the final variable. You could reconstruct everything but that will take a while, no? John Doe will possibly think: "I will just enter javascript:alert(pass3) in my browser to pop up a window with the pass. OK… huh? Why is the box empty?"

A big hint to everyone: always try the script with some bibberish else some variables/actions won't yet be initialized/used. So no wonder JD gets an empty alertbox: the operation pass + pass2 in the pass3 variable was never excuted thus it doesn't contain any value!

After excuting the script with random values JD finds the pass with javascript:alert(pass3) and he lives happely ever after…

NOTE 1: Scripts could not be in the page itself but in an external file. You can use the JSView extension for Firefox to easily find external javascripts/css-files.

NOTE 2: the method described in 3 requires some logical thinking () and you will need to view the script itself to get the variable (duh!). () e.g. if the script says if (enteredpassword==pass) {…} don't start looking in the variable pass3 or anything ;)

Voila, I hope this article helped you and contained just what you were expecting. If you want to know or you're thinking: "Why isn't this or that discussed here?" Just leave a comment and I'll add it or simply write a v2 of my article ;)

The_Cell