mrrootsec

Deobfuscating / Unminifying Obfuscated Web App Code

Table of Contents

• PoC
• Tools
  • Unsorted
• wakaru

mrrootsec

##FILE SPACING:

 # double space a file
 sed G

 # double space a file which already has blank lines in it. Output file
 # should contain no more than one blank line between lines of text.
 sed '/^$/d;G'

 # triple space a file

mrrootsec

javascript:(function() {
    var scripts = document.getElementsByTagName("script");
    var regex = /(?<=(\"|\%27|\`))\/[a-zA-Z0-9_?&=\/\-\#\.]*(?=(\"|\'|\%60))/g;
    var jsRegex = /(?<=(\"|\'|\%60))(?:\/|https?:\/\/)[a-zA-Z0-9_?&=\/\-\#\.]+\.js(?:\?[^"'%60]*)?(?=(\"|\'|\%60))/g;
    const results = new Set();
    const paramMap = new Map();
    const jsFiles = new Set();

    function processContent(t, src) {
        var e = t.matchAll(regex);

mrrootsec

javascript:(function() {     const e = document.documentElement.innerText.match(/[a-zA-Z_\-]+/g),           n = [...new Set(e)].sort(),           popup = document.createElement('div');      popup.style.position = 'fixed';     popup.style.top = '10%';     popup.style.left = '10%';     popup.style.width = '80%';     popup.style.height = '80%';     popup.style.backgroundColor = 'black';     popup.style.color = 'white';     popup.style.zIndex = '10000';     popup.style.padding = '20px';     popup.style.overflowY = 'scroll';     popup.style.border = '2px solid green';     popup.style.borderRadius = '10px';      const title = document.createElement('h1');     title.innerText = 'Current page wordlist';     title.style.color = 'green';     popup.appendChild(title);      const wordList = document.createElement('div');     wordList.innerHTML = n.join('<br>');     popup.appendChild(wordList);      const closeButton = document.createElement('button');     closeButton.innerText = 'Close';     closeButton.style.position = 

mrrootsec

Add-Type -TypeDefinition @"

using System;
using System.Runtime.InteropServices;

public class MouseSimulator {
  [DllImport("user32.dll", SetLastError = true)]
  private static extern void mouse_event(uint dwFlags, int dx, int dy, uint dwData, int dwExtraInfo);
  private const uint MOUSEEVENTF_MOVE = 0x0001;
  

mrrootsec

{
  "swagger" : "2.0",
  "info" : {
    "version" : "1.0.100",
    "title" : "title<script language=\"javascript\">alert('1')</script>",
    "description" : "description with **markdown** format <script language=\"javascript\">alert('script-in-description')</script> <img src=x onerror=alert(\"img-in-description\")>"
  },
  "tags" : [ {
    "name" : "Admin",
    "description" : "tag with **markdown**"