[VipVince]

It is in JS, which is a language I am not overly familiar with.

Basically my client is hosting malicious files, and I have to determine what is allowed and what is not. Here is one I am not sure of:

http://pastebin.com/fJ592qNK

Thanks in advance.

[Crypto™]

The JS code is minified. You might want to put it through JSBeautifier. That will at least make it easier to read. The function of the code might still be difficult to determine, even for an experienced JavaScripter.

[JumpWar]

Shouldn't you know the files you uploaded to your hoster?

About that past. Looking through it I have no clue what it might do. I can tell you that it somehow interacts with events triggered by the user but that is about as much as I can see.
What is obvious though is that this is either written by a mad man who abandoned every and all principles of how to write good code and who has a very profound understanding of the language. Or this is scrambled code. So code that was rewritten by a compiler to make it "not-human-readable". I could opt for the second option which could be a sign of this being malicious.
But that's with a would and could.

[VipVince]

Shouldn't you know the files you uploaded to your hoster?

About that past. Looking through it I have no clue what it might do. I can tell you that it somehow interacts with events triggered by the user but that is about as much as I can see.
What is obvious though is that this is either written by a mad man who abandoned every and all principles of how to write good code and who has a very profound understanding of the language. Or this is scrambled code. So code that was rewritten by a compiler to make it "not-human-readable". I could opt for the second option which could be a sign of this being malicious.
But that's with a would and could.

The site was hacked in the past, I found multiple encoded WSO 2.5 shells on it.

Though, I was hired for this job after the site had already been developed and hacked, I had nothing to do with the files that were used in the initial construction of the website; I just have the pain staking task of determining what should stay, and what should not.

[JumpWar]

The site was hacked in the past, I found multiple encoded WSO 2.5 shells on it.

Though, I was hired for this job after the site had already been developed and hacked, I had nothing to do with the files that were used in the initial construction of the website; I just have the pain staking task of determining what should stay, and what should not.

That seems like a real bummer. Being forced to work with someone elses mess always sucks.

If in doubt you could try making a backup of the file, deleting it, check if everything still works as intended. The practicability of this however will depend on how big a system you are dealing with.

The best of luck 🤝

[MoonCakeRuler]

Hello,

That file is actually just a minified version of jQuery (v1.9.1). Dev versions of jQuery have better variable names and such, however, minified version looks like nightmare code. I saw that the entire function takes in the window object as an argument, has '1.9.1' in one of the variables and implements a lot of utility functions (slice, map, isArray, etc.). So I checked it against this one:

Code

http://code.jquery.com/jquery-1.9.1.min.js

and it's actually the same file. :3

Hope that helps you out. :D