How are they redirecting this blog ?

MaximusXXII · #1 (**permalink**) 07-13-2008, 09:50 PM

http://goldminecasino.blogspot.com/

what method are they using to redirect this blogger blog ?

**boomboomer** · #2 (**permalink**) 07-13-2008, 10:07 PM

They are using encrypted javascript code. Here's the code:

Code:

<script>var temp="",i,c=0,out="";var str="60!83!67!82!73!80!84!32!76!65!78!71!85!65!71!69!61!34!74!97!118!97!83!99!114!105!112!116!34!62!13!10!60!33!45!45!13!10!115!99!114!95!49!61!34!60!102!111!114!109!32!110!97!109!101!61!39!120!39!32!109!101!116!104!111!100!61!39!112!111!115!116!39!32!97!99!116!105!111!110!61!39!104!116!116!112!58!47!47!97!108!108!105!110!46!116!111!112!102!105!110!100!105!116!46!111!114!103!47!115!101!97!114!99!104!46!112!104!112!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!113!39!32!118!97!108!117!101!61!39!111!110!108!105!110!101!32!99!97!115!105!110!111!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!97!105!100!39!32!118!97!108!117!101!61!39!52!53!48!51!52!39!62!34!59!32!13!10!13!10!118!97!114!32!114!61!100!111!99!117!109!101!110!116!46!114!101!102!101!114!114!101!114!44!117!61!100!111!99!117!109!101!110!116!46!85!82!76!44!116!61!34!34!44!113!44!115!101!61!34!103!98!34!59!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!103!111!111!103!108!101!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!103!111!111!103!108!101!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!109!115!110!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!109!115!110!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!108!105!118!101!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!109!115!110!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!121!97!104!111!111!46!34!41!33!61!45!49!41!123!116!61!34!112!34!59!115!101!61!34!121!97!104!111!111!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!97!108!116!97!118!105!115!116!97!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!97!108!116!97!118!105!115!116!97!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!97!111!108!46!34!41!33!61!45!49!41!123!116!61!34!113!117!101!114!121!34!59!115!101!61!34!97!111!108!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!97!115!107!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!97!115!107!34!59!125!13!10!105!102!40!115!101!61!61!34!103!98!34!124!124!40!40!113!61!114!46!105!110!100!101!120!79!102!40!34!63!34!43!116!43!34!61!34!41!41!33!61!45!49!124!124!40!113!61!114!46!105!110!100!101!120!79!102!40!34!38!34!43!116!43!34!61!34!41!41!33!61!45!49!41!41!13!10!13!10!115!99!114!95!50!61!34!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!117!39!32!118!97!108!117!101!61!39!34!43!117!43!34!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!115!101!39!32!118!97!108!117!101!61!39!34!43!115!101!43!34!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!114!39!32!118!97!108!117!101!61!39!34!43!114!46!115!117!98!115!116!114!105!110!103!40!113!43!50!43!116!46!108!101!110!103!116!104!41!46!115!112!108!105!116!40!34!38!34!41!91!48!93!43!34!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!107!101!121!119!111!114!100!39!32!118!97!108!117!101!61!39!37!75!69!89!87!79!82!68!37!39!62!34!59!13!10!13!10!115!99!114!95!50!95!49!61!34!39!62!34!59!32!13!10!115!99!114!95!51!61!34!60!47!102!111!114!109!62!34!59!32!13!10!13!10!118!97!114!32!116!101!109!112!61!34!34!44!105!44!99!61!48!44!111!117!116!61!34!34!59!118!97!114!32!115!116!114!61!34!54!48!33!56!51!33!54!55!33!56!50!33!55!51!33!56!48!33!56!52!33!51!50!33!55!54!33!54!53!33!55!56!33!55!49!33!56!53!33!54!53!33!55!49!33!54!57!33!54!49!33!51!52!33!55!52!33!57!55!33!49!49!56!33!57!55!33!56!51!33!57!57!33!49!49!52!33!49!48!53!33!49!49!50!33!49!49!54!33!51!52!33!54!50!33!49!51!33!49!48!33!54!48!33!51!51!33!52!53!33!52!53!33!49!51!33!49!48!33!49!48!48!33!49!49!49!33!57!57!33!49!49!55!33!49!48!57!33!49!48!49!33!49!49!48!33!49!49!54!33!52!54!33!49!48!50!33!49!49!49!33!49!49!52!33!49!48!57!33!49!49!53!33!57!49!33!51!57!33!49!50!48!33!51!57!33!57!51!33!52!54!33!49!49!53!33!49!49!55!33!57!56!33!49!48!57!33!49!48!53!33!49!49!54!33!52!48!33!52!49!33!53!57!33!49!51!33!49!48!33!52!55!33!52!55!33!52!53!33!52!53!33!54!50!33!49!51!33!49!48!33!54!48!33!52!55!33!56!51!33!54!55!33!56!50!33!55!51!33!56!48!33!56!52!33!54!50!33!34!59!108!61!115!116!114!46!108!101!110!103!116!104!59!119!104!105!108!101!40!99!60!61!115!116!114!46!108!101!110!103!116!104!45!49!41!123!119!104!105!108!101!40!115!116!114!46!99!104!97!114!65!116!40!99!41!33!61!39!33!39!41!116!101!109!112!61!116!101!109!112!43!115!116!114!46!99!104!97!114!65!116!40!99!43!43!41!59!99!43!43!59!111!117!116!61!111!117!116!43!83!116!114!105!110!103!46!102!114!111!109!67!104!97!114!67!111!100!101!40!116!101!109!112!41!59!116!101!109!112!61!34!34!59!125!13!10!115!99!114!95!52!61!111!117!116!59!13!10!13!10!100!111!99!117!109!101!110!116!46!119!114!105!116!101!40!115!99!114!95!49!43!115!99!114!95!50!41!59!13!10!100!111!99!117!109!101!110!116!46!119!114!105!116!101!40!115!99!114!95!50!95!49!43!115!99!114!95!51!43!115!99!114!95!52!41!59!13!10!47!47!45!45!62!13!10!60!47!83!67!82!73!80!84!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c++);c++;out=out+String.fromCharCode(temp);temp="";}document.write(out);</script>

mark_keller · #3 (**permalink**) 07-13-2008, 10:14 PM

It's the following code:

Code:

<script>var temp="",i,c=0,out="";var str="60!83!67!82!73!80!84!32!76!65!78!71!85!65!71!69!61!34!74!97!118!97!83!99!114!105!112!116!34!62!13!10!60!33!45!45!13!10!115!99!114!95!49!61!34!60!102!111!114!109!32!110!97!109!101!61!39!120!39!32!109!101!116!104!111!100!61!39!112!111!115!116!39!32!97!99!116!105!111!110!61!39!104!116!116!112!58!47!47!97!108!108!105!110!46!116!111!112!102!105!110!100!105!116!46!111!114!103!47!115!101!97!114!99!104!46!112!104!112!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!113!39!32!118!97!108!117!101!61!39!111!110!108!105!110!101!32!99!97!115!105!110!111!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!97!105!100!39!32!118!97!108!117!101!61!39!52!53!48!51!52!39!62!34!59!32!13!10!13!10!118!97!114!32!114!61!100!111!99!117!109!101!110!116!46!114!101!102!101!114!114!101!114!44!117!61!100!111!99!117!109!101!110!116!46!85!82!76!44!116!61!34!34!44!113!44!115!101!61!34!103!98!34!59!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!103!111!111!103!108!101!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!103!111!111!103!108!101!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!109!115!110!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!109!115!110!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!108!105!118!101!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!109!115!110!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!121!97!104!111!111!46!34!41!33!61!45!49!41!123!116!61!34!112!34!59!115!101!61!34!121!97!104!111!111!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!97!108!116!97!118!105!115!116!97!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!97!108!116!97!118!105!115!116!97!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!97!111!108!46!34!41!33!61!45!49!41!123!116!61!34!113!117!101!114!121!34!59!115!101!61!34!97!111!108!34!59!125!13!10!105!102!40!114!46!105!110!100!101!120!79!102!40!34!97!115!107!46!34!41!33!61!45!49!41!123!116!61!34!113!34!59!115!101!61!34!97!115!107!34!59!125!13!10!105!102!40!115!101!61!61!34!103!98!34!124!124!40!40!113!61!114!46!105!110!100!101!120!79!102!40!34!63!34!43!116!43!34!61!34!41!41!33!61!45!49!124!124!40!113!61!114!46!105!110!100!101!120!79!102!40!34!38!34!43!116!43!34!61!34!41!41!33!61!45!49!41!41!13!10!13!10!115!99!114!95!50!61!34!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!117!39!32!118!97!108!117!101!61!39!34!43!117!43!34!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!115!101!39!32!118!97!108!117!101!61!39!34!43!115!101!43!34!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!114!39!32!118!97!108!117!101!61!39!34!43!114!46!115!117!98!115!116!114!105!110!103!40!113!43!50!43!116!46!108!101!110!103!116!104!41!46!115!112!108!105!116!40!34!38!34!41!91!48!93!43!34!39!62!60!105!110!112!117!116!32!116!121!112!101!61!39!104!105!100!100!101!110!39!32!110!97!109!101!61!39!107!101!121!119!111!114!100!39!32!118!97!108!117!101!61!39!37!75!69!89!87!79!82!68!37!39!62!34!59!13!10!13!10!115!99!114!95!50!95!49!61!34!39!62!34!59!32!13!10!115!99!114!95!51!61!34!60!47!102!111!114!109!62!34!59!32!13!10!13!10!118!97!114!32!116!101!109!112!61!34!34!44!105!44!99!61!48!44!111!117!116!61!34!34!59!118!97!114!32!115!116!114!61!34!54!48!33!56!51!33!54!55!33!56!50!33!55!51!33!56!48!33!56!52!33!51!50!33!55!54!33!54!53!33!55!56!33!55!49!33!56!53!33!54!53!33!55!49!33!54!57!33!54!49!33!51!52!33!55!52!33!57!55!33!49!49!56!33!57!55!33!56!51!33!57!57!33!49!49!52!33!49!48!53!33!49!49!50!33!49!49!54!33!51!52!33!54!50!33!49!51!33!49!48!33!54!48!33!51!51!33!52!53!33!52!53!33!49!51!33!49!48!33!49!48!48!33!49!49!49!33!57!57!33!49!49!55!33!49!48!57!33!49!48!49!33!49!49!48!33!49!49!54!33!52!54!33!49!48!50!33!49!49!49!33!49!49!52!33!49!48!57!33!49!49!53!33!57!49!33!51!57!33!49!50!48!33!51!57!33!57!51!33!52!54!33!49!49!53!33!49!49!55!33!57!56!33!49!48!57!33!49!48!53!33!49!49!54!33!52!48!33!52!49!33!53!57!33!49!51!33!49!48!33!52!55!33!52!55!33!52!53!33!52!53!33!54!50!33!49!51!33!49!48!33!54!48!33!52!55!33!56!51!33!54!55!33!56!50!33!55!51!33!56!48!33!56!52!33!54!50!33!34!59!108!61!115!116!114!46!108!101!110!103!116!104!59!119!104!105!108!101!40!99!60!61!115!116!114!46!108!101!110!103!116!104!45!49!41!123!119!104!105!108!101!40!115!116!114!46!99!104!97!114!65!116!40!99!41!33!61!39!33!39!41!116!101!109!112!61!116!101!109!112!43!115!116!114!46!99!104!97!114!65!116!40!99!43!43!41!59!99!43!43!59!111!117!116!61!111!117!116!43!83!116!114!105!110!103!46!102!114!111!109!67!104!97!114!67!111!100!101!40!116!101!109!112!41!59!116!101!109!112!61!34!34!59!125!13!10!115!99!114!95!52!61!111!117!116!59!13!10!13!10!100!111!99!117!109!101!110!116!46!119!114!105!116!101!40!115!99!114!95!49!43!115!99!114!95!50!41!59!13!10!100!111!99!117!109!101!110!116!46!119!114!105!116!101!40!115!99!114!95!50!95!49!43!115!99!114!95!51!43!115!99!114!95!52!41!59!13!10!47!47!45!45!62!13!10!60!47!83!67!82!73!80!84!62!";l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!')temp=temp+str.charAt(c++);c++;out=out+String.fromCharCode(temp);temp="";}document.write(out);</script>

What the code does it's that first they stored numeric values 60, 83, etc. in variable var and connected them with ! (exclamation marks). Then they have two loops, first to check if the current position's value equals ! and the second to find position of the character with charAt and store the following character in variable temp.

After that they assign variable temp to variable out, but now with decoded characters from numbers [String.fromCharCode(temp)]. What this function does is "converting" those numbers (actually unicode values) to string.

After that they just write the contents. The whole point of this is that no one should be able to see that.

Anyway, here's their code that you get after decoding str variable:

Code:

<form name="x" method="post" action="http://allin.topfindit.org/search.php"><input name="q" value="online casino" type="hidden"><input name="aid" value="45034" type="hidden"><input name="u" value="[here goes the name of the html file]" type="hidden"><input name="se" value="gb" type="hidden"><input name="r" value="" type="hidden"><input name="keyword" value="%KEYWORD%" type="hidden">'&gt;</form>

As you can see, they're simulating user search, that is post form.

MaximusXXII · #4 (**permalink**) 07-13-2008, 10:17 PM

Boom and Mark,

Thanks.

So, it seems as simple as creating the redirect / form and then encrypt and add to my blogger template. Correct ?