Decode this strange Javascript

2020-02-06 03:11发布

I came across this code in a .js file. What is this code ??

I have downloaded that file onto my localhost webserver.Keeping this code in the .js file redirects me to google.com and when i am commenting this code the page runs perfectly !!

I can understand that this is done to enforce that the page is to be executed from a server link only !!!

How can i decode this js ???

[]['\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72']['\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72'](self['\x75\x6e\x65\x73\x63\x61\x70\x65']('%69%66%28%7e%6c%6f%63%61%74%69%6f%6e%2e%70%72%6f%74%6f%63%6f%6c%2e%69%6e%64%65%78%4f%66%28%27%68%74%74%70%3a%27%29%26%26%7e%6c%6f%63%61%74%69%6f%6e%2e%68%6f%73%74%2e%69%6e%64%65%78%4f%66%28%27%74%65%6d%70%6c%61%74%65%2d%68%65%6c%70%2e%63%6f%6d%27%29%29%7b%7d%65%6c%73%65%28%6c%6f%63%61%74%69%6f%6e%2e%68%72%65%66%3d%27%68%74%74%70%3a%2f%2f%77%77%77%2e%67%6f%6f%67%6c%65%2e%63%6f%6d%27%29'))()

7条回答
迷人小祖宗
2楼-- · 2020-02-06 03:39

It is doubly-coded, first as %nn URL-style characters, then as \xnn string characters. It decodes to

[]['constructor']['constructor'](
  self['unescape']('
    if(~location.protocol.indexOf('http:')&&~location.host.indexOf('template-help.com')){}
    else(location.href='http://www.google.com')
  '))()

Note that the quotes no longer nest properly after decoding, and the ['unescape'] has already been done.

查看更多
登录 后发表回答