Skip to content

Instantly share code, notes, and snippets.

@ziplokk1
Created July 3, 2017 02:46
Show Gist options
  • Save ziplokk1/5a6a1e0ede02d8942e21d309a06a67c9 to your computer and use it in GitHub Desktop.
Save ziplokk1/5a6a1e0ede02d8942e21d309a06a67c9 to your computer and use it in GitHub Desktop.
Newest revision of incapsula's obfuscated js code from whoscored.com
(function() {
function getSessionCookies() {
var cookieArray = new Array();
var cName = /^\s?incap_ses_/;
var c = document.cookie.split(";");
for (var i = 0; i < c.length; i++) {
var key = c[i].substr(0, c[i].indexOf("="));
var value = c[i].substr(c[i].indexOf("=") + 1, c[i].length);
if (cName.test(key)) {
cookieArray[cookieArray.length] = value;
}
}
return cookieArray;
}
function setIncapCookie(vArray) {
var res;
try {
var cookies = getSessionCookies();
var digests = new Array(cookies.length);
for (var i = 0; i < cookies.length; i++) {
digests[i] = simpleDigest((vArray) + cookies[i]);
}
var sl = "jcMQV+ffvh2BmAcW8nq2a1HZRZcsB5poBUV2Ew==";
var dd = digests.join();
var asl = '';
for (var i=0;i<sl.length;i++) {
asl += (sl.charCodeAt(i) + dd.charCodeAt(i % dd.length)).toString(16);
}
res = vArray + ",digest=" + dd + ",s=" + asl;
} catch (e) {
res = vArray + ",digest=" + (encodeURIComponent(e.toString()));
}
createCookie("___utmvc", res, 20);
}
function simpleDigest(mystr) {
var res = 0;
for (var i = 0; i < mystr.length; i++) {
res += mystr.charCodeAt(i);
}
return res;
}
function createCookie(name, value, seconds) {
var expires = "";
if (seconds) {
var date = new Date();
date.setTime(date.getTime() + (seconds * 1000));
var expires = "; expires=" + date.toGMTString();
}
document.cookie = name + "=" + value + expires + "; path=/";
}
function test(o) {
var res = "";
var vArray = new Array();
for (var j = 0; j < o.length; j++) {
var test = o[j][0];
switch (o[j][1]) {
case "exists":
try {
if(typeof(eval(test)) != "undefined"){
vArray[vArray.length] = encodeURIComponent(test + "=true");
}
else{
vArray[vArray.length] = encodeURIComponent(test + "=false");
}
} catch (e) {
vArray[vArray.length] = encodeURIComponent(test + "=false");
}
break;
case "value":
try{
try {
res = eval(test);
if(typeof(res) === "undefined"){
vArray[vArray.length] = encodeURIComponent(test + "=undefined");
}
else if(res === null){
vArray[vArray.length] = encodeURIComponent(test + "=null");
}
else {
vArray[vArray.length] = encodeURIComponent(test + "=" + res.toString());
}
} catch (e) {
vArray[vArray.length] = encodeURIComponent(test + "=cannot evaluate");
break
}
break;
}
catch (e) {
vArray[vArray.length] = encodeURIComponent(test + "=" + e);
}
case "plugin_extentions":
try {
var extentions = [];
try {
i = extentions.indexOf("i");
} catch (e) {
vArray[vArray.length] = encodeURIComponent("plugin_ext=indexOf is not a function");
break;
}
try {
var num = navigator.plugins.length;
if (num == 0 || num == null) {
vArray[vArray.length] = encodeURIComponent("plugin_ext=no plugins");
break;
}
} catch (e) {
vArray[vArray.length] = encodeURIComponent("plugin_ext=cannot evaluate");
break;
}
for (var i=0;i<navigator.plugins.length;i++) {
if (typeof(navigator.plugins[i]) == "undefined") {
vArray[vArray.length] = encodeURIComponent("plugin_ext=plugins[i] is undefined");
break;
}
var filename = navigator.plugins[i].filename;
var ext = "no extention";
if (typeof(filename) == "undefined") {
ext = "filename is undefined";
}
else if (filename.split(".").length > 1) {
ext = filename.split('.').pop();
}
if (extentions.indexOf(ext) < 0) {
extentions.push(ext);
}
}
for (i = 0; i < extentions.length; i++) {
vArray[vArray.length] = encodeURIComponent("plugin_ext=" + extentions[i]);
}
}
catch (e) {
vArray[vArray.length] = encodeURIComponent("plugin_ext=" + e);
}
break;
}
}
vArray = vArray.join();
return vArray;
}
var o = [
["navigator", "exists"],
["navigator.vendor", "value"],
["navigator.appName", "value"],
["navigator.plugins.length==0", "value"],
["navigator.platform", "value"],
["navigator.webdriver", "value"],
["platform", "plugin_extentions"],
["ActiveXObject", "exists"],
["webkitURL", "exists"],
["_phantom", "exists"],
["callPhantom", "exists"],
["chrome", "exists"],
["yandex", "exists"],
["opera", "exists"],
["opr", "exists"],
["safari", "exists"],
["awesomium", "exists"],
["puffinDevice", "exists"],
["__nightmare", "exists"],
["_Selenium_IDE_Recorder", "exists"],
["document.__webdriver_script_fn", "exists"],
["document.$cdc_asdjflasutopfhvcZLmcfl_", "exists"],
["process.version", "exists"],
["navigator.cpuClass", "exists"],
["navigator.oscpu", "exists"],
["navigator.connection", "exists"],
["window.outerWidth==0", "value"],
["window.outerHeight==0", "value"],
["window.WebGLRenderingContext", "exists"],
["document.documentMode", "value"],
["eval.toString().length", "value"]
];
try {
setIncapCookie(test(o));
document.createElement("img").src = "/_Incapsula_Resource?SWKMTFSR=1&e=" + Math.random();
} catch (e) {
img = document.createElement("img");
img.src = "/_Incapsula_Resource?SWKMTFSR=1&e=" + e;
}
})();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment