InformAction Forums

Posted: **Sat Mar 28, 2009 6:43 pm**

Hi Giorgio Maone,

I went over here, and tried this out:
http://fantomaster.com/fantomasSuite/sh ... ersv-e.cgi
First I found up this code somewhere:

Code: Select all

<html>
<head>
<title>Expandible row test in firefox</title>
<STYLE type="text/css">
.collapsed
{
DISPLAY: none;
}
</STYLE>
<script language="javascript" type="text/javascript">
//***collapsible rows
function outliner(evt) {
evt = (evt) ? evt : (window.event) ? window.event : "";
var oMe;
if (evt.srcElement) {
oMe = evt.srcElement;
} else if (evt.target) {
oMe = evt.target;
}
if (evt.srcElement) {
//for IE
var child = document.all[oMe.getAttribute("child",false)];
}
else {
//for Firefox
var child = document.getElementById[oMe.getAttribute("child",false)];
}
//get child element
//if child element exists, expand or collapse it.
if (null != child)
child.className = child.className == "collapsed" ? "expanded" : "collapsed";
}
function changepic(evt) {
evt = (evt) ? evt : (window.event) ? window.event : "";
var uMe;
if (evt.srcElement) {
uMe = evt.srcElement;
} else if (evt.target) {
uMe = evt.target;
}
var check = uMe.src.toLowerCase();
if (check.lastIndexOf("expand.gif") != -1)
{
uMe.src = "collapse.gif";
}
else
{
uMe.src = "expand.gif";
}
}
</script>
</head>
<body onclick="outliner(event)">
<table cellpadding="2" cellspacing="0" width="98%" class="infotable" bgcolor="#f4f4f4">
<caption class="issuetitle">NARMC Sleep Disorders Clinic Intake Form</caption>
<thead >
<tr>
<th class="header" width="1%" />
<td class="header"> Last Name:</td>
<td class="header"> First Name:</td>
<td class="header"> Gender:</td>
</tr>
</thead>

<tr>
<td class="content"><A HREF="javascript:" onClick="document.getElementById['srcidDBData115847296']"><IMG border="0" alt="expand/collapse" class="expandable" height="11" onclick="changepic(event)" src="expand.gif" width="9" child="srcidDBData115847296" ></A></td>
<td class="content">Caloris</td>
<td class="content">Morris</td>
<td class="content">M</td>
</tr>

<tr class="collapsed" bgcolor="#ffffff" id="srcidDBData115847296">
<td colspan="4"> Test
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>

then encoded it to this

Code: Select all

<html>
<head>
<title>Expandible row test in firefox</title>
<STYLE type="text/css">
.collapsed
{
DISPLAY: none;
}
</STYLE>
<script language="javascript" type="text/javascript">
//***collapsible rows
function outliner(evt) {
evt = (evt) ? evt : (window.event) ? window.event : "";
var oMe;
if (evt.srcElement) {
oMe = evt.srcElement;
} else if (evt.target) {
oMe = evt.target;
}
if (evt.srcElement) {
//for IE
var child = document.all[oMe.getAttribute("child",false)];
}
else {
//for Firefox
var child = document.getElementById[oMe.getAttribute("child",false)];
}
//get child element
//if child element exists, expand or collapse it.
if (null != child)
child.className = child.className == "collapsed" ? "expanded" : "collapsed";
}
function changepic(evt) {
evt = (evt) ? evt : (window.event) ? window.event : "";
var uMe;
if (evt.srcElement) {
uMe = evt.srcElement;
} else if (evt.target) {
uMe = evt.target;
}
var check = uMe.src.toLowerCase();
if (check.lastIndexOf("expand.gif") != -1)
{
uMe.src = "collapse.gif";
}
else
{
uMe.src = "expand.gif";
}
}
</script>
</head>
<body onclick="outliner(event)">
<table cellpadding="2" cellspacing="0" width="98%" class="infotable" bgcolor="#f4f4f4">
<caption class="issuetitle">NARMC Sleep Disorders Clinic Intake Form</caption>
<thead >
<tr>
<th class="header" width="1%" />
<td class="header"> Last Name:</td>
<td class="header"> First Name:</td>
<td class="header"> Gender:</td>
</tr>
</thead>

<tr>
<td class="content"><A HREF="javascript:" onClick="document.getElementById['srcidDBData115847296']"><IMG border="0" alt="expand/collapse" class="expandable" height="11" onclick="changepic(event)" src="expand.gif" width="9" child="srcidDBData115847296" ></A></td>
<td class="content">Caloris</td>
<td class="content">Morris</td>
<td class="content">M</td>
</tr>

<tr class="collapsed" bgcolor="#ffffff" id="srcidDBData115847296">
<td colspan="4"> Test
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>

Question in NoScript the stealthed code is handled exactly similar to the "straight" variety? I guess so, but can you verify?

luntrus

Posted: **Sat Mar 28, 2009 9:37 pm**

Unless it is making changes to the code (either purposely or due to an error in the coding of the encoder) then there should be no difference whatsoever. All the encoding does (should do) is to make it more difficult for you or I to garner the meaning of the code.

The browser shouldn't care what it looks like, so long as it knows how to use the information presented.

But now that we know, we can take that obscured code & convert it back to a more readable form, after which we still need to ask someone else what it means

.

Though even with the browser understanding how to "read" the information presented, NoScript, which I guess you could consider as a filter, must also check specifically for all potential cases. If it did not, then the code would be transparent to NoScript.

And as we've seen over time, both Mozilla & NoScript had to be updated to patch "code" that was not, or not correctly, being interpreted.

Posted: **Sat Mar 28, 2009 9:59 pm**

For Mozilla to run it, Mozilla must understand it first.
If Mozilla can understand it, NoScript can as well

However, that "ultimate stealth" is ridiculous -- just plain old HTML encoding.
There are several more convoluted ways to obfuscate code, but at the end of the day the bold proposition above applies.

Posted: **Sun Mar 29, 2009 2:16 am**

Giorgio Maone wrote:For Mozilla to run it, Mozilla must understand it first.
If Mozilla can understand it, NoScript can as well

However, that "ultimate stealth" is ridiculous -- just plain old HTML encoding.
There are several more convoluted ways to obfuscate code, but at the end of the day the bold proposition above applies.

Agreed, the attempt at "encoding" is pretty amateur.

InformAction Forums

How does NoScript handle this?

How does NoScript handle this?

Re: How does NoScript handle this?

Re: How does NoScript handle this?

Re: How does NoScript handle this?