当前位置：网站首页>Dynamically debug JS code

Dynamically debug JS code

2022-07-21 04:43:00 【Jelly cavalierly】

Preface

In some CTF In the race , Often some topics are given a coded JavaScript Code , In the end there will be eval() A function like this .
eval() function
eval Function evaluates a string as a numeric expression , Its grammar is ：

eval(expr)

here expr Is a string parameter that is evaluated .

If the string is an expression ,eval Find the value of the expression ;

If this parameter represents one or more JavaScript sentence , that eval Execute these statements .

eval Function can be used to convert a date from a format （ Always string ） Convert to a numeric expression or number .

The following is Hetian CTF Here's an example , Give a very messy JS Code , But in execution JavaScript In the process of code , It can be done to eval Function down , Check the decoded JS Code .
First , take js Code compilation html Webpage , for example 
<html>
<head>
<title>js Code debugging </title>
<script>_='function $(){e=getEleById("c").value;length==16^be0f23233ace98aa$c7be9){tfls_aie}na_h0lnrg{e_0iit\'_ns=[t,n,r,i];for(o=0;o<13;++o){	[0]);.splice(0,1)}}}	\'<input id="c">< οnclick=$()>Ok</>\');delete _var ","docu.)match(/"];/)!=null=["	write(s[o%4]buttonif(e.ment';for(Y in $='	')with(_.split($[Y]))_=join(pop());
eval(_)</script>
</head>
<body>
</body>
</html>
stay Chrome Execute this web page in the browser , Then open the firebug 



<script>_='function $(){e=getEleById("c").value;length==16^be0f23233ace98aa$c7be9){tfls_aie}na_h0lnrg{e_0iit\'_ns=[t,n,r,i];for(o=0;o<13;++o){	[0]);.splice(0,1)}}}	\'<input id="c">< οnclick=$()>Ok</>\');delete _var ","docu.)match(/"];/)!=null=["	write(s[o%4]buttonif(e.ment';for(Y in $='	')with(_.split($[Y]))_=join(pop());eval(_)</script>
stay eval After the function breaks , Reload this page , You can go to VM231 See the decoded js Code , as follows 

function $()
{var e=document.getElementById("c").value;
if(e.length==16)
if(e.match(/^be0f23/)!=null)
if(e.match(/233ac/)!=null)
if(e.match(/e98aa$/)!=null)
if(e.match(/c7be9/)!=null)
{var t=["fl","s_a","i","e}"];
var n=["a","_h0l","n"];
var r=["g{","e","_0"];
var i=["it'","_","n"];
var s=[t,n,r,i];
for(var o=0;o<13;++o){
document.write(s[o%4][0]);s[o%4].splice(0,1)}
}}document.write('<input id="c"><button οnclick=$()>Ok</button>');delete _

flag{it's_a_h0le_in_0ne}


原网站

版权声明
本文为[Jelly cavalierly]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/202/202207200551469680.html

边栏推荐

猜你喜欢

随机推荐