SitePoint Sponsor

User Tag List

Results 1 to 9 of 9
  1. #1
    SitePoint Evangelist
    Join Date
    Dec 2005
    Posts
    527
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    I can not undresntand !!!

    Who can help me what is the maening of this code ?


    <script type="text/javascript">
    var img_path = 'templates/default/images/';
    var member_ID = 0;
    document.write(''+unescape('%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%69%6E%64%65%78%2E%6A%73%2E%70%68%70%3F%74%63%6F%33%2B%30%61%30%4F%6B%6E%50%6C%2B%62%2B%47%41%6A%61%58%68%54%64%37%48%6E%6A%6D%4E%4B%35%6A%66%68%4A%73%69%4D%66%73%46%59%22%3E%3C%2F%73%63%72%69%70%74%3E'));
    </script>
    <script type="text/javascript">
    io('tco3+0a0OknPl+b+GAjaXve1rY34HGqIYOZdLxh0hV8');
    </script>

    is it an encoded code ?
    how I can decode it ?

  2. #2
    SitePoint Zealot trekmp's Avatar
    Join Date
    Dec 2005
    Posts
    158
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Here's how to get what the main block looks like, just copy and paste its

    Code:
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml">
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
    <title>Untitled Document</title>
    <script type="text/javascript">
    	function start() {
    	var img_path = 'templates/default/images/';
    	var member_ID = 0;
    	document.getElementById('mydata').value=unescape('%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%7 8%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%69%6E%64%65%78%2E%6 A%73%2E%70%68%70%3F%74%63%6F%33%2B%30%61%30%4F%6B%6E%50%6C%2B%62%2B%47%41%6A%6 1%58%68%54%64%37%48%6E%6A%6D%4E%4B%35%6A%66%68%4A%73%69%4D%66%73%46%59%22%3E%3 C%2F%73%63%72%69%70%74%3E');
    	}
    </script>
    </head>
    
    <body onload="start();">
    <h1>Output</h1>
    <textarea cols="50" rows="10" id="mydata"></textarea>
    </body>
    </html>
    It looks like its trying a access a file then run an function called io
    Why do we exist? What is our purpose?
    >H2O Developments
    >USS Endeavour
    >Hosted@Servage

  3. #3
    SitePoint Evangelist
    Join Date
    Dec 2005
    Posts
    527
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    My output is :

    Code:
    <script t%  79pe="te%7 8t/javascript" src="index.%6   As.php?tco3+0a0OknPl+b+GAj%6   1XhTd7HnjmNK5jfhJsiMfsFY">%3   C/script>
    What is the meaning of this ?!!!!
    I need the URL/File name.

  4. #4
    Caveat surfer Buddy Bradley's Avatar
    Join Date
    May 2003
    Location
    Cambridge, UK
    Posts
    2,366
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    It looks like it's probably index.php with some querystring variables passed to it.

  5. #5
    SitePoint Evangelist
    Join Date
    Dec 2005
    Posts
    527
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    I think the decodation is not complete and have some problems maybe "src="index.%6 As.php" is "src="index.php"


    Who I can find the correct link I tested with this query string but counld not show any code

  6. #6
    SitePoint Evangelist
    Join Date
    Dec 2005
    Posts
    527
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    ????????????

  7. #7
    SitePoint Wizard
    Join Date
    Nov 2004
    Location
    Nelson BC
    Posts
    2,310
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Get rid of the spaces in the encoded part then decode it, you get:
    Code:
    <script type="text/javascript" src="index.js.php?tco3+0a0OknPl+b+GAjaXhTd7HnjmNK5jfhJsiMfsFY"></script>
    So the page is loading a script that is found at that URL and presumably has a function "io" contained within.

  8. #8
    SitePoint Evangelist
    Join Date
    Dec 2005
    Posts
    527
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Thank you

    How you undrestand index.%6 As.php means index.js.php ???

    I opened this link and I saw a downloadble file with this content :

    Code:
    )>- 5,S0>;K62: b od)>- 5,K0+>3L6%: b od)>- 5,K0+>3Q0 b od)>- 5,S0>;:;Q0 b od)>- />8:S0>;:; b 9>3,:d)>- 7+23S0>;:; b 9>3,:d)>- 61<3*;:;Y63:, b 1:( ^-->&wvd)>- %t ,+-d)>- -:, b xxd90- w)>- 6bod 6c1*2q3:18+7d 6ttv $69 w1*2q<7>-\0;:wo'iYot/>-,:V1+w1*2q<7>-^+w6vvvd" :3,: -:, tb 1*2q<7>-^+w6vd"-:+*-1 -:,d")>- 60 b 61<3*;:@01<:d
    (it is some of the codes)
    Is it encoded to?

  9. #9
    SitePoint Evangelist
    Join Date
    Dec 2005
    Posts
    527
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    I found many codes like up.

    How I can decode them ??


Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •