【转】仅用 []()+! 就足以实现几乎任意Javascript代码

原文:http://discogscounter.getfreehosting.co.uk/js-noalnum.php?txt=alert%28%22hi+there%22%29

请在Firefox下测试

看了下例子:

js代码

<script>

alert("hi there")

</script>

就等价于

<script>

([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]])([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+(!![]+[])[+[]]+[][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])

</scirpt>

它实现的原理，有一个码表

1.     (NaN+[]["filter"])[11]',
   
2. !   window["atob"]("If")[0]',
   
3. "   ("").fontcolor()[12]',
   
4. #   window["atob"]("0iN")[1]',
   
5. $   window["atob"]("0iT")[1]',
   
6. %   window["atob"]("0iW")[1]',
   
7. &   window["atob"]("0ia")[1]',
   
8. '   window["atob"]("0if")[1]',
   
9. (   (false+[]["filter"])[20]',
   
10. )   (false+[]["filter"])[21]',
    
11. *   window["atob"]("0ir")[1]',
    
12. +   window["atob"]("0it")[1]',
    
13. ,   window["atob"]("0iy")[1]',
    
14. -   (NaN+window["Date"]())[31]',
    
15. .   window["atob"]("1i4")[1]',
    
16. /   (true+("")["sub"]())[10]',
    
17. 0-9 ignored*/ ,,,,,,,,,,
    
18. :   window["Date"]()[21]',
    
19. ;   window["atob"]("O0")[0]',
    
20. <   ("")["sub"]()[0]',
    
21. =   ("").fontcolor()[11]',
    
22. >   ("")["sub"]()[10]',
    
23. ?   window["atob"]("0j9")[1]',
    
24. @   window["atob"]("00A")[1]',
    
25. A   (+[]+[]["constructor"])[10]',
    
26. B   (+[]+(false)["constructor"])[10]',
    
27. C   window["atob"]("00N")[1]',
    
28. D   window["btoa"](00)[1]',
    
29. E   window["btoa"](01)[2]',
    
30. F   (0+[]["filter"]["constructor"])[10]',
    
31. G   window["btoa"]("0f")[1]',
    
32. H   window["btoa"]("0t")[1]',
    
33. I   ("Infinity")[0]',
    
34. J   window["atob"]("00r")[1]',
    
35. K   window["btoa"]("(")[0]',
    
36. L   window["btoa"]("/")[0]',
    
37. M   window["btoa"](0)[0]',
    
38. N   ("NaN")[0]',
    
39. O   window["btoa"](8)[0]',
    
40. P   window["btoa"]("<")[0]',
    
41. Q   window["btoa"]("a")[1]',
    
42. R   window["atob"]("01I")[1]',
    
43. S   window["btoa"]("I")[0]',
    
44. T   window["btoa"]("N")[0]',
    
45. U   window["atob"]("01W")[1]',
    
46. V   window["atob"]("01a")[1]',
    
47. W   (true+window)[12]',
    
48. X   window["atob"]("01i")[1]',
    
49. Y   window["btoa"]("a")[0]',
    
50. Z   window["btoa"]("f")[0]',
    
51. [   (undefined+[]["filter"])[33]',
    
52. \   window["atob"]("01y")[1]',
    
53. ]   (true+[]["filter"])[40]',
    
54. ^   window["atob"](014)[1]',
    
55. _   window["atob"](018)[1]',
    
56. `   window["atob"]("02A")[1]',
    
57. a   ("false")[1]',
    
58. b   (window+[])[2]',
    
59. c   ([]["filter"]+[])[3]',
    
60. d   ("undefined")[2]',
    
61. e   ("true")[3]',
    
62. f   ("false")[0]',
    
63. g   ([]+("")["constructor"])[14]',
    
64. h   window["atob"]("aN")[0]',
    
65. i   ([false]+undefined)[10]',
    
66. j   (window+[])[3]',
    
67. k   window["atob"]("a0")[0]',
    
68. l   ("false")[2]',
    
69. m   (Number+[])[11]',
    
70. n   ("undefined")[1]',
    
71. o   (true+[]["filter"])[10]',
    
72. p   window["atob"]("cN")[0]',
    
73. q   window["atob"]("cf")[0]',
    
74. r   ("true")[1]',
    
75. s   ("false")[3]',
    
76. t   ("true")[0]',
    
77. u   ("undefined")[0]',
    
78. v   (0+[]["filter"])[30]',
    
79. w   ([]["sort"]["call"]()+[])[13]',
    
80. x   window["atob"]("eN")[0]',
    
81. y   (NaN+[Infinity])[10]',
    
82. z   window["atob"]("et")[0]',
    
83. {   (NaN+[]["filter"])[21]',
    
84. |   window["atob"]("03y")[1]',
    
85. }   (NaN+[]["filter"])[41]',
    
86. ~   window["atob"](234)[1]'

拼接出来字符串 "eval"，如何把 "eval" 变成 eval() 呢？方法是
[]["sort"]["call"]()["eval"]
其中 []["sort"]["call"]() 等于 [].sort.call() ，等价于 window，所以上面 []["sort"]["call"]()["eval"] 就等价于 window.eval。

然后就是体力活了，把码表对应转换成 eval("blah blah") 这种形式就可以执行任意代码了

不同浏览器的码表不一样。Chrome和Firefox的index就不一样。

其实这个码表还可以通过 ·toLocal*()` 函数族扩展到Unicode，比fromCharCode要简短