Filter Evasion
Javascript
Base64 encoded payload
eval(atob(<b64>))
[].contructor.contructor(atob(<b64>))()
setTimeout(atob(<b64>))
setInterval(atob(<b64>))
Function(atob(<b64>))Loose typing conversions
Boolean FALSE
![]
!{}
!!""
[]=={}Boolean TRUE
!![]
!!{}
!""
[]==""Convert a boolean to literal string (i.e. "true" and "false"). Works with any of the comparisons listed above
Integer 0, can be implicitly casted to FALSE
Integer 1, can be implicitly casted as TRUE. To obtain 1 we sum FALSE to TRUE
To generate other Integer numbers simply sum the expression of one to itself 2 or more times
String characters
Extract a character from a string. By combining integer expressions for indexes and strings generated by the expression above it is possible to access the single characters and combine them to form malicious instructions and bypass filters
URI Obfuscation
Automatic login
Host obfuscation
Last updated