Connect with Expertise | Find Experts, Get Answers, Share Insights

Encrypted javascript, or what?

 
Join Date: Feb 2010
Posts: 2
#1: Feb 7 '10
Hello,

I downloaded a Wordpress theme. In the header.php document I ran across the following code:

Expand|Select|Wrap|Line Numbers
  1. <script language="JavaScript" type="text/javascript">var i,y,x="3c6469762069643d22777261707065722220636c6173733d2266697822203e0d0a093c64697620636c6173733d22706167656c696e6573706f73206e61762d69636f6e223e3c6120636c6173733d22706167656c696e65732220687265663d22687474703a2f2f7777772e7769636b65642d776f726470726573732d7468656d65732e636f6d223e3c3f706870206563686f20706167656c696e65732827637265647465787427293b3f3e3c2f613e3c2f6469763e0d0a202020203c6469762069643d226865616465722220636c6173733d22666978223e0d0a0909";y='';for(i=0;i<x.length;i+=2){y+=unescape('%'+x.substr(i,2));}document.write(y);
  2. </script>
Is this some sort of encryption? If so, is there any way to encrypt the script and find out exactly what it says/means?


// gaff

Dormilich's Avatar
E
M
C
 
Join Date: Aug 2008
Location: Leipzig, Germany
Posts: 5,395
#2: Feb 7 '10

re: Encrypted javascript, or what?


sure, that "encoding" (well, rather an obfuscation) is percent escape stripped off the % signs, easily recognisable by the clear text code at the end.
acoder's Avatar
E
M
C
 
Join Date: Nov 2006
Location: UK
Posts: 14,979
#3: Feb 7 '10

re: Encrypted javascript, or what?


Yep, change
Expand|Select|Wrap|Line Numbers
  1. document.write(y);
to
Expand|Select|Wrap|Line Numbers
  1. alert(y);
 
Join Date: Feb 2010
Posts: 2
#4: Feb 7 '10

re: Encrypted javascript, or what?


Thank you guys for your help. It worked fine.
 
Join Date: Mar 2010
Posts: 1
#5: Mar 24 '10

re: Encrypted javascript, or what?


Hello, I have a similar problem - how do I go about fixing this? (sorry I'm new so any step by step directions would be greatly appreciated!)

Is this very malicious or just posts a link?
Dormilich's Avatar
E
M
C
 
Join Date: Aug 2008
Location: Leipzig, Germany
Posts: 5,395
#6: Mar 25 '10

re: Encrypted javascript, or what?


obfuscated code tends to be either annoying or malicious.
Reply