+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: [Help] Decode/Deobfuscate/Decrypt Javascript (/showthread.php?tid=5852212)
[Help] Decode/Deobfuscate/Decrypt Javascript - Juffar - Jun 21, 2018
The file basically looks like this.
PHP Code
<?php
var _0x4775=['\x65\x72\x72\x6f\x72','\x65\x78\x63\x65\x70\x74\x69\x6f\x6e','\x74\x72\x61\x63\x65','\x6c\x6f\x67','\x6f\x6e\x6b\x65\x79\x70\x72\x65\x73\x73','\x65\x76\x65\x6e\x74','\x6f\x6e\x6d\x6f\x75\x73\x65\x64\x6f\x77\x6e','\x6f\x6e\x6b\x65\x79\x64\x6f\x77\x6e','\x6b\x65\x79\x43\x6f\x64\x65','\x61\x6c\x6c','\x6c\x61\x79\x65\x72\x73','\x77\x68\x69\x63\x68','\x63\x61\x70\x74\x75\x72\x65\x45\x76\x65\x6e\x74\x73'
Please inbox me if you can do it and I'll give you the full file/text.
RE: [Help] Decode/Deobfuscate/Decrypt Javascript - stapel - Jun 21, 2018
think i could do that. send you a pm :)
RE: [Help] Decode/Deobfuscate/Decrypt Javascript - CyberStrike - Jun 21, 2018
(Jun 21, 2018 03:47 AM)Juffar Wrote: The file basically looks like this.
PHP Code
<?php
var _0x4775=['\x65\x72\x72\x6f\x72','\x65\x78\x63\x65\x70\x74\x69\x6f\x6e','\x74\x72\x61\x63\x65','\x6c\x6f\x67','\x6f\x6e\x6b\x65\x79\x70\x72\x65\x73\x73','\x65\x76\x65\x6e\x74','\x6f\x6e\x6d\x6f\x75\x73\x65\x64\x6f\x77\x6e','\x6f\x6e\x6b\x65\x79\x64\x6f\x77\x6e','\x6b\x65\x79\x43\x6f\x64\x65','\x61\x6c\x6c','\x6c\x61\x79\x65\x72\x73','\x77\x68\x69\x63\x68','\x63\x61\x70\x74\x75\x72\x65\x45\x76\x65\x6e\x74\x73'
Please inbox me if you can do it and I'll give you the full file/text.
That is hex, same stuff we see in shell code it says:
errorexceptiontracelogonkeypresseventonmousedownonkeydownkeyCodealllayerswhichcaptureEvents
https://www.rapidtables.com/convert/number/hex-to-ascii.html
Edit: More than likely you will see another variable or two with hex like this variable, and at the end it will have a place that it calls all these variables.. it's just obfuscation I have seen it on a few compromised sites where the malicious attacker is doing something like messing with cookies, and then doing redirects .. stuff like that.