The Daily WTF: Curious Perversions in Information Technology
Welcome to TDWTF Forums Sign in | Join | Help
in Search

Recursive javascript security

Last post 07-09-2008 7:27 PM by Carnildo. 28 replies.
Page 1 of 1 (29 items)
Sort Posts: Previous Next
  • 07-07-2008 9:41 PM

    Recursive javascript security

    Check out this page.



    http://www.careercc.com/resumpr.shtml

    These guys don't want you to see how they made thier awesome HTML codes work so you cannot right click.

    If you happen to get through thier first line of defence, fear not they have a contingency for that! Darn! That the source code is not available.

    Now for you uber 1337 hackers out there who manage to hack your way past security measure number 2, you will NEVER get passed their 1337 obfuscation algorithm designed to hide thier first line of defence so you cannot discover how to defeat it.

    See how far you can "hack" this site!

     

     

    Filed under:
  • 07-07-2008 9:55 PM In reply to

    Re: Recursive javascript security

     And, of course, the wonderful comment in their source code:

    <!-- CHANGE THE ABOVE THREE LINES -->

     

  • 07-07-2008 10:32 PM In reply to

    Re: Recursive javascript security

                    <center><center><center><center><center><center><center><center>
    <center><center>
    <p align="left">

     

    ...used repeatedly throughout the page, especially later on. In the last 1/8 of the source (as measured by scrollbar), they do this between every paragraph. There is one forest of 10 </center>'s, but that comes right before the real <center>ing starts. Whoever (or whatever) wrote this page is FREAKING INSANE.

    The obfuscated script also breaks middle-click by detecting right-clicks with "event.button>1".

  • 07-07-2008 11:00 PM In reply to

    Re: Recursive javascript security

    One of the funniest and WTFy things I've seen in HTML is: <center align="left">.

  • 07-07-2008 11:17 PM In reply to

    Re: Recursive javascript security

    I loved this.  I showed my 'uber skillz' to my wife, showing her the ridiculousness of these kinds of websites.  When I went to 'view source', she saw the "Source code not available" and immediately noticed how tiny the scroll bar looked, and asked me to scrolll down.  If this website can't fool my wife, who has no html and programming experience, who did it fool to convince someone that this would be useful? 

  • 07-07-2008 11:25 PM In reply to

    Re: Recursive javascript security

    Note the navigation that fails to work if JavaScript is off.

    And by the way, I never actually right-click to view source.  All the cool kids use Ctrl+U.

    It's more likely then you think.

    Filed under:
  • 07-07-2008 11:28 PM In reply to

    Re: Recursive javascript security

    joe.edwards:

    One of the funniest and WTFy things I've seen in HTML is: <center align="left">.

    At least that doesn't work, at least on firefox (it still centers), but you peaked my curiosity... <center style='text-align: left;'> works (And I use works very loosely here...).

  • 07-08-2008 12:03 AM In reply to

    Re: Recursive javascript security

    Then they escaped some code, making it virtually indecipherable (LOL); unless, of course, you have to deal with this sort of thing on a daily basis & you've written a handy utility:

  • 07-08-2008 4:43 AM In reply to

    Re: Recursive javascript security

    joemck:
    The obfuscated script also breaks middle-click by detecting right-clicks with "event.button>1".
    Not on Opera - the script just doesn't work. OTOH Opera spontaneously (and consistently) breaks middle-click if you don't restart it often enough.
  • 07-08-2008 6:22 AM In reply to

    • Zecc
    • Top 75 Contributor
    • Joined on 06-12-2007
    • Posts 363

    Re: Recursive javascript security

    KludgeQueen:
    unless, of course, you have to deal with this sort of thing on a daily basis & you've written a handy utility
    You should add an option of running the output through a code beautifier / indenter.

    As for the <center> non-sense:

    <meta name="GENERATOR" content="Microsoft FrontPage 5.0">

    And does think it's better to use those arrows to scroll the page instead of using the scrollbar or the mouse wheel?

    If mixed metaphors were illegal, I'd be having an indigestion.
  • 07-08-2008 6:43 AM In reply to

    • WWWWolf
    • Top 100 Contributor
    • Joined on 12-05-2005
    • Oulu, Finland
    • Posts 234

    Re: Recursive javascript security

    ShaggyB:

    Check out this page.



    Aaah, you're making us scroll down! That is a lesson well learned from the last thread about JS obfuscation.

    ShaggyB:

    http://www.careercc.com/resumpr.shtml

    These guys don't want you to see how they made thier awesome HTML codes work so you cannot right click.

    Funny how the left sidebar isn't word-wrapped at all. Why do people who hide source always have shitty web templates that no one wants to steal?

    :right click: "You may not right click mouse this page" :click OK: :context menu springs right up:

    Never fails to amuse me.

    :ctrl+S: Works fine! :ctrl+U: Works fine!

    Scroll down! Scroll down! (Like we learned in the last thread)

    Too bad I don't have Firefox Web Developer toolbar installed on this computer or I'd grab the generated source in no time at all...

    mysql> help contents;

    Nothing found
    Please try to run 'help contents' for a list of all accessible topics

    Desktop Search Rain - Gothic Computing's EASY button

    (Go wild^H^H^H^H figure)
  • 07-08-2008 7:28 AM In reply to

    Re: Recursive javascript security

    WWWWolf:
    Too bad I don't have Firefox Web Developer toolbar installed on this computer or I'd grab the generated source in no time at all...
     

    I'm glad that Firebug now has a view source option as well, because Pederick's webdev toolbar's view source stopped's working in FFX3 (known issue).

     

    I'm curious where the recursion is, by the way.

    — Flurp.
  • 07-08-2008 7:29 AM In reply to

    Re: Recursive javascript security

    Vempele:
    OTOH Opera spontaneously (and consistently) breaks middle-click if you don't restart it often enough.
    What's "often enough"? This instance of Opera has been running since 15:18:32 11.6.2008 (according to Process Explorer), and I have no problems with middle click scrolling (this reminds me, I should probably upgrade to 9.51 - I skipped on 9.50 final as it is).
    Because 10 billion years' time is so fragile, so ephemeral... it arouses such a bittersweet, almost heartbreaking fondness.
  • 07-08-2008 8:23 AM In reply to

    Re: Recursive javascript security

    ender:
    Vempele:
    OTOH Opera spontaneously (and consistently) breaks middle-click if you don't restart it often enough.
    What's "often enough"? This instance of Opera has been running since 15:18:32 11.6.2008 (according to Process Explorer), and I have no problems with middle click scrolling (this reminds me, I should probably upgrade to 9.51 - I skipped on 9.50 final as it is).

    9.5 (and 9.51) have been kind of touchy, it seems. I think they have some minor stability issues to work out. On the other hand, I love the improvements. On the first hand, they changed all the keyboard shotcuts! Argh!

  • 07-08-2008 8:23 AM In reply to

    Re: Recursive javascript security

     Guys, it's perfectly understandable that they don't want anybody stealing the code they've worked so hard on....

    //Page Scroller (aka custom scrollbar)- By Dynamic Drive
    //For full source code and more DHTML scripts, visit http://www.dynamicdrive.com
    //This credit MUST stay intact for use

    At least they kept the credits around for (nobody) to see.

     

  • 07-08-2008 10:53 AM In reply to

    Re: Recursive javascript security

     404 Recursivity Not Found

     

    The title of this post is TRWTF.

  • 07-08-2008 12:50 PM In reply to

    Re: Recursive javascript security

    Umm.... so this is their uber-sensitive, top secret code they tried so depsparately hard to hide from us? WTF?

    The only code they're hiding is the code to prevent right-clicking, in an effort to hide their code. So that's why this is "recursive" security. :P

     

    <SCRIPT type="text/javascript">
    <!--
        am="You may not right click mouse this page";
        bV=parseInt(navigator.appVersion);
        bNS=navigator.appName=="Netscape";
        bIE=navigator.appName=="Microsoft Internet Explorer";

        function nrc(e)
        {
            if(bNS && e.which>1)
            {
                alert(am);
                return false
            }
            else
            if(bIE && (event.button>1))
            {
                alert(am);
                return false
            }
        }

        document.onmousedown=nrc;

        if(document.layers)
            window.captureEvents(Event.MOUSEDOWN);

        if(bNS && bV<5)
            window.onmousedown=nrc;

        function one()
        {
            return true
        }

        onerror=one;

    //--></SCRIPT>

  • 07-08-2008 6:00 PM In reply to

    Re: Recursive javascript security

    Dudes have apparently never heard of wget.  Geez.  Do they think "View Source" is the only way to get to the source for a page?

     

  • 07-08-2008 6:05 PM In reply to

    Re: Recursive javascript security

    WWWWolf:

    Funny how the left sidebar isn't word-wrapped at all. Why do people who hide source always have shitty web templates that no one wants to steal?

    Another thing: Look at those strange scroll buttons.

    One of them is simply a rotated version of the other so the drop shadows don't match. And neither of them looks right! A drop shadow on the bottom right would probably look ok.

    Who would steal such crap?

    Filed under:
  • 07-08-2008 6:52 PM In reply to

    Re: Recursive javascript security

    KludgeQueen:

    Unless, of course, you have to deal with this sort of thing on a daily basis & you've written a handy utility

     

    You just scared me...

  • 07-08-2008 9:14 PM In reply to

    Re: Recursive javascript security

    Volmarias:
    ender:
    Vempele:
    OTOH Opera spontaneously (and consistently) breaks middle-click if you don't restart it often enough.
    What's "often enough"? This instance of Opera has been running since 15:18:32 11.6.2008 (according to Process Explorer), and I have no problems with middle click scrolling (this reminds me, I should probably upgrade to 9.51 - I skipped on 9.50 final as it is).

    9.5 (and 9.51) have been kind of touchy, it seems. I think they have some minor stability issues to work out. On the other hand, I love the improvements. On the first hand, they changed all the keyboard shotcuts! Argh!

    Agreed. Who though it would be a good idea to change the "find next" shortcut? I thought everyone got together and decided on F3 ages ago.
  • 07-08-2008 9:22 PM In reply to

    • u2892
    • Not Ranked
    • Joined on 04-15-2008
    • Posts 5

    Re: Recursive javascript security

    The right-click blocker seems to do absolutely nothing in Firefox...

     

  • 07-08-2008 9:37 PM In reply to

    Re: Recursive javascript security

    u2892:
    The right-click blocker seems to do absolutely nothing in Firefox...

    Firefox has an option to keep the context menu intact, but that dosen't stop the alert form appearing.  However, some web applications (*cough* Google Docs */cough*) require you to disable this option in order to use the custom context menus.  If that option's off, the context menu dosen't show.

    It's more likely then you think.

  • 07-09-2008 3:30 AM In reply to

    Re: Recursive javascript security

     

    KludgeQueen:

    Then they escaped some code, making it virtually indecipherable (LOL); unless, of course, you have to deal with this sort of thing on a daily basis & you've written a handy utility:

    WScript.echo(unescape("...")); is a lot easier

  • 07-09-2008 3:56 AM In reply to

    Re: Recursive javascript security

    seconddevil:

     

    KludgeQueen:

    Then they escaped some code, making it virtually indecipherable (LOL); unless, of course, you have to deal with this sort of thing on a daily basis & you've written a handy utility:

    WScript.echo(unescape("...")); is a lot easier

     

    javascriptalert(unescape("...")); void 0; is even easier then that.

    It's more likely then you think.

  • 07-09-2008 6:36 AM In reply to

    • zzo38
    • Top 200 Contributor
    • Joined on 02-10-2008