Wednesday, December 1, 2010

Non-AlphaNumeric Javascript

This is not a new topic, but incase people didn't know, it is possible to craft javascript using only symbols such as : "![]{}+" and etc.

The idea is to take the returned value from an expression and collect the alphabet and/or numerical values from it.

So for starter, lets create some numerical value using symbols.

+[]      ->      0  (it seems the plus sign forces the expression into integer)
So you can do something like
$ = +[]  // $ == 0
++$ //$ == 1
--$ //$ == 0
So you can generate all the numerical values you want using the above method.  There are other ways to generate numerical value, such as ~[]   ->  -1. 

Great, now to generate strings, we will leverage the returned value of an expression.

![]  ->  Boolean False
!![]  ->  Boolean True.

![] + "" -> false ( + "" forces the return expression into a String)
!![] + "" -> true

So now to collect specific alphabet, (this works in FF but not IE =( ), is access the string as an array.
(![] + "")[0] == f, (![] + "")[1] == a, and etc.  So you can take advantage using symbols to generate numerical value and using it as index to access a character in the string.

Other ways to access other alphabets can be ({} + "") == [Object object].  So you can extract the text within it using indexing as well.  So again, the main idea is to extract the return value from an expression.  As there are many different return values, it is possible to build functional javascript using pure symbols.

Check the following link for more information on non alpha numerical Javascript:

http://sla.ckers.org/forum/read.php?24,33349
http://extraexploit.blogspot.com/2010/10/dollars-javascript-code-yet-another.html