Okay, so we see a lot of encrypted javascripts when researching about online malwares. MalZilla is the tool of our choice. We often wonder about different obfuscating techniques that these authors might use. Some are downright 0day or unknown and some are known. These are the packers/obfuscators, we found people have been mostly using:
1. Daft Code: This javascript obfuscator is intended to be used as a resource to convert human readable javascript to a more shrouded code. This serves two purposes:
- Makes it harder for others to copy and paste blocks of code
- Reduces file size hence saves outgoing bandwidth for you and incoming bandwidth for your visitors
2. Dean Edwards Packer: This is probably the most used JS obfuscator. It has been used in numerous malwares that we have seen yet. At version 3, it is very successful.
3. JsCrunch: jscrush is a free web-based tool to reduce the size of JavaScript files by stripping out any unnecessary white-space. You can process multiple JavaScript files and concatenate them into one single file for better performance on your web site. JavaScript code can be compressed further by enabling code obfuscation, which also makes the code unreadable by most people. Processed JavaScript files remain available on this site for download for one hour. After this point, the JavaScript files will be removed from the server.
4. Shane’s JavaScriptObfuscator: This is an open source JavaScriptObfuscator. It is good generally, but it does not process regular expression literals.
5. Dynamic Tools JavaScript compressor: You can compress & obfuscate your javascript files with this free online javascript compressor. Compressing your scripts will make them download faster, reduce bandwidth usage and make it harder for others to steal your code. The javascript compressor leaves function names and global variables untouched, so your script will continue to work with other scripts.
It has a nice live ‘squeeze’ table.
6. ScriptAsylum Javascript Encoder: This script will encode javascript to make it more difficult for people to read and/or steal.
Ofcourse, we know that there are many more out there, but these are the ones that are mostly used by ‘them’.
UPDATE:
7. YUI Compressor: The YUI Compressor is written in Java (requires Java >= 1.4) and relies on Rhino to tokenize the source JavaScript file. It starts by analyzing the source JavaScript file to understand how it is structured. It then prints out the token stream, omitting as many white space characters as possible, and replacing all local symbols by a 1 (or 2, or 3) letter symbol wherever such a substitution is appropriate (in the face of evil features such as eval or with, the YUI Compressor takes a defensive approach by not obfuscating any of the scopes containing the evil statement) The CSS compression algorithm uses a set of finely tuned regular expressions to compress the source CSS file. The YUI Compressor is open-source!
8. JSMin: JSMin is a filter which removes comments and unnecessary whitespace from JavaScript files. It typically reduces filesize by half, resulting in faster downloads. It also encourages a more expressive programming style because it eliminates the download cost of clean, literate self-documentation.
9. DojoCompressor: Being based on a real parse stream, the Dojo compressor can get a better idea for the context of a token (variable name, etc.) than the regular-expression based tools.
UPDATE 2:
10. Huffman JavaScript Compression: Huffman encoding is based on the principle that letters that appear more frequently should have a smaller code than the ones that are used less often. So, in the English language, vowels would be used more than the letter ‘z’, and would get shorter codes. This JavaScript-based compression example uses this method to compress whatever you give it. It can work on web pages, JavaScript code, and tons more. The downfall is that it is extremely slow. It also re-encodes the binary data in a method similar to UUEncode, which inflates 3 bytes of binary data to 4 bytes of textual data, so some of the awesome compression that is possible will be eliminated from the expansion of data.
Searches leading to this post:Compress and obfuscate Javascript, compressor javascript, Javascript obfuscator free online, js online compressor, list out the compressor, online javascript compressor, online javascript encoder, YUI javascript Vulnerability
Comments on this entry are closed.