Post Reply 
Removing obfuscation before modifying script?
Nov. 24, 2012, 01:37 PM (This post was last modified: Nov. 24, 2012 03:30 PM by neverwasinparis.)
Post: #4
RE: Removing obfuscation before modifying script?
I wonder about the answers, 'cause it is possible.
the solution for this request is in the basics of JavaScript. you will have to get into the slipstream. ever wondered what the '{}' in JavaScript are for? they make sure the commands within are executed 'together'. so all you have to do is to inject a '{' at the very beginning and a '}' at the very end of all JavaScripts and put function calls of own functions in these slipstream. the functions should be stored in a js-file in the html folder of Proxomitron. another filter injects a script at the beginning of each site that loads this file. make sure that script deletes itself. you don't want to leave any traces. the best trick of a Proxomitron user is to make the webmaster believe he does not exist. so make also sure you remove your function calls. otherwise a webmaster could see them for example with innerHTML, outerHTML or firstChild. be careful to not disintegrate anything. the molecular structure of the scripts have to stay completely intact.
manipulating JavaScript that way is the best I can imagine. that way it is irrelevant HOW JavaScript code you want to mainpulate is written, if it uses specific commands, tries to hide or whatever. your own functions concentrate on WHAT has been done not on HOW it has been done. if for example you want to remove a specific div element you can remove it before it has been displayed. or you can remove images or iFrames before they are sending a http-request. the limit of possibilities depends on your JavaScript skills.

here a filter to do this for external scripts:

Code:
Name = "Manipulate external Scripts"
Active = TRUE
Multi = TRUE
URL = "$SET(a=1)"
Bounds = "($TYPE(js)|$TYPE(vbs))(^$IHDR(Content-Disposition:( ) attachment))(((?)\0(^?)$SET(1=\0\n/**/}if(self.ProxManipulateEnd)ProxManipulateEnd()})$STOP())|($TST(a=1)(?)\0$SET(1={{if(self.ProxManipulateBeginning)ProxManipulateBeginning();\0)$SET(a=)))"
Limit = 2
Match = "*"
Replace = "\1"

it's a really shiny filter. it needs only 2 bytes and injects

Code:
{{if(self.ProxManipulateBeginning)ProxManipulateBeginning();

at the beginning and

Code:
\n/**/}if(self.ProxManipulateEnd)ProxManipulateEnd()}

at the end with no matter of the size of the script.

it's much harder to manipulate internal scripts if you want to manipulate all of them and in a safe way. to do so you need to set the byte limit to infinity. that is tricky 'cause you need filters that emulate a primitive HTML parser.
but for today I stop here. test manipulating external scripts. you will love it.
Add Thank You Quote this message in a reply
Post Reply 


Messages In This Thread
RE: Removing obfuscation before modifying script? - neverwasinparis - Nov. 24, 2012 01:37 PM

Forum Jump: