jcrweb1

Webpages source fishing
Javascript "protections"

by jcr
(08 September 1997)

Courtesy of Fravia's page of reverse engineering

Well, this is a VERY interesting essay, in my opinion... see, if you have a look at my antismut pages, you'll see that one of them is dedicated to the gathering of tiny information snippets that are frequently "forgotten" inside the html source code of many pages. I have personally destroyed many sites using those informations. You may need some other tools: a java decompiler (in order to disassemble java compiled code, duh) and a "classviewer" (and a java virtual machine of course) in order to practicize this kind of nice activity... in the mean time you'll have your fun just examining the source code of all "suspect" pages, as jcr teaches us with this very interesting example of a stupid web protection. Here is what he wrote to me:




fravia: i came across this web protection that made me laugh, and 

then cry. I's just dumb, dumb dumb dumb.

And the most saddening aspect is that the guy does have a brain, 

because the code is interesting.

It's like shorting out a terribly complex copy protection scheme 

with a silly simple jmp.

       



jcr    (j, seer of the code)        





Webpages source fishing 

Javascript "protections"

by jcr, September 1997



A candidate for the stupidest (web-based) protection scheme: 

I'm sorry if this is not appropriate material, but i just had to document

this blatant misuse of a brain (such a terrible thing to waste!).

This is not at all a crack, and has nothing to do with disassembly language,

but it is the st00pidest implementation of "security" on the web i have ever                            

seen. 



While i was persuing after our beloved softice 3.2 (yes 3.2), walking the

warez road for all it's sin, (i'd buy the damn thing but i haven't

scrounged up a bleeding cent towards the 559$US or so needed, this hacking

gig isn't putting down the bills, you catch?)  anyway, i came across this

silly little site at:

         

             http://www.octonline.com/usr/fity07/main.htm

	          (which does NOT host THE debugger)



the story, as the author writes, is that you have to click on these ad 

banners, muck around through all this bullshit commercialization, and find 

a keyphrase (uh-oh) in order to enter the warez site. 

I'm not into that, i don't like that, so i won't do that. 

I hit the warez site, and sure enough am presented with a form asking me to 

login. 

Let's see first of all if there is anything in the markup that i can use to 

my advantage:  (please excuse: here is the mark in its entirety):





pwd.htm:



<HTML><HEAD>

<SCRIPT LANGUAGE="JavaScript">

<!-- Hide from JavaScript-Impaired Browsers

al="`1234567890-=~!@#$%^&*()_+qwer"

+"tyuiop[]QWERTYUIOP{}|asdfghjkl;A"

+"SDFGHJKL:zxcvbnm,./ZXCVBNM<>?";

ab1="";

bctr=0;

function ckPwd(){

 tst=document.isn.username.value

 +"*"+document.isn.passwrd.value+"*";

 ls=document.pd.pe.value;

 a=eval(ls.substring(0,2))-91;

 ls=ls.substring(2,ls.length);

 nls="";

 flg=0;

 while (ls.length>12){

  ab=eval(ls.substring(0,2))-89;

  ab1=(ab1==""?""+ab:ab1);

  oab1=ab1;

  ls=ls.substring(2,ls.length);

  for (var i=0;i<ab;i++){

   nr=eval(ls.substring(0,2))-a;

   ls=ls.substring(2,ls.length);

   nls+=al.charAt(nr);

   }

  nls+="*";

  if (nls.indexOf(tst)>-1){

   ls="";

   flg=1;

   }

  }

 if (flg==1){

  tstOk();

  }

 else{

  bctr++;

  if (bctr>3){

  /* Be sure to put the name of the page

     here to which you want visitors are to be

     sent after three tries if they FAIL to enter 

     a correct password and user name. */

   location.href="error.htm";

   }

  else{

   alert("Sorry. Bad Username or Password."

   +" Failed Attempt #"+bctr+".");

   }

  }

 }



function tstOk(){

 ab1=ab1+""+a;

  alert("OK. You Entered a Valid Username and Password, "

  +document.isn.username.value+"! Taking you to the"

  +" restricted page as soon as you click OK.");

  location.href="pwdss.htm?"+ab1;              <---- gee, thats sweet

 }



function srand() {

 today=new Date();

 rand=today.getTime();

 picker=""+rand

 picker=picker.charAt((picker.length-4));

 rec=eval(picker);

 } // End Hiding --> </SCRIPT> </HEAD> <BODY BGCOLOR="white"><CENTER>

<FORM NAME="pd"> 



<!-- IMPORTANT: After you run the pseudo-encrypter, you will get a

"hidden" form element constructed especially for your own user names and

passwords. Paste that form element right below this note and above the end

of form tag. --> 



<!-- Paste this element into your main script named pwd.htm in the

location indicated -->



<INPUT TYPE='hidden' NAME='pe'

VALUE='999881643741603841598498816759606041815967 '> </FORM>



<!-- You may put any page content you wish here The HTML below for the

password entry is presently set for blue background and white type. You

may change colors to fit your own page design without impacting on the

script, so long as the form elements stay the same.  -->





<FORM NAME="isn">

<TABLE BORDER=2 CELLPADDING=5 CELLSPACING=0 BGCOLOR=BLUE>

<TR><TD COLSPAN=2 ALIGN=CENTER><FONT SIZE=4 COLOR=WHITE 

FACE="helvetica,arial,geneva"><B>Password Access<BR>to Our Restricted 

Pages</B></FONT></TD></TR>

<TR><TD><FONT SIZE=3 COLOR=WHITE><B>Your User Name:</B></FONT></TD>

<TD><INPUT TYPE="text" NAME="username" VALUE="" SIZE=10></TD></TR>

<TR><TD><FONT SIZE=3 COLOR=WHITE><B>Your Password:</B></FONT></TD>

<TD><INPUT TYPE="password" NAME="passwrd" VALUE="" SIZE=10></TD></TR>

<TR><TD COLSPAN=2 ALIGN=CENTER><INPUT TYPE="button" NAME="btn" 

VALUE=" Submit " onClick="ckPwd();return false;"></TD></TR>

</TABLE></FORM>



<!-- Put any other content you wish on your page here -->



<SCRIPT LANGUAGE="JavaScript">

<!-- Hide JavaScript from Java-Impaired Browsers

/* This little script at the bottom of your

   page isn't strictly necessary, but it does

   put the visitor's cursor in the password form.

   It's a small, but polite and thoughtful thing

   to do for your visitors. */

document.isn.username.focus();

// End Hiding -->

</SCRIPT>

</BODY>

</HTML>

         



And here is the effect.

        



The whole thing reminds me so much of deprotecting and otherwise

reengineering, that i couldn't help but think of fravia and the stupid

protectionists page. (or is that just "stupid protections" page?) anyways,

right there, right in the middle of the markup i stare at a link to the

following scrap of markup: 

  

pwdss.htm:



<!-- Create this intervening page named "pwdss.htm" to help keep the

restricted page URL a bit more difficult to discern. -->



<HTML><HEAD><SCRIPT LANGUAGE="JavaScript">

ck=location.search;

if (ck!="?98"){

/* Substitute your own WRONG

    destination here. */

 location.href="error.htm";             <-- Wanna this page   

 }

else{

 /* Put the correct restricted

    page name here. */

 location.href="waret.htm";             <-- or rather this one?     

 }

</SCRIPT></HEAD></HTML>

     </center>

                

The moral of this sad tale is: don't waste your time coercing your markup

language to implement security. IT WON'T DO, YOU CANNOT HIDE BEHIND

YOUR JAVASCRIPT, NOR YOUR JAVA CLASS, NOR YOUR ACTIVE-X. If the

protectionist's code must live on a host, it will never be secure. 

Sad to say, this protection would be secure only to the most naive 

web-idiot ("uhh, what's 'view source'... an option?") 



Or: don't confuse obscurity and obsfucation with security.



j, seer of the code.



ps: or maybe i'm just the rare sort that happens to source the majority 

of the web pages encountered... and for that matter... of the programs 

encountered ;-)

You are deep inside fravia's page of reverse engineering, choose your way out:

cocktails

is reverse engineering legal?

by jcr (08 September 1997)

by jcr
(08 September 1997)