Decoding iframe protected page
- Thread starter neoakenz
- Start date
webblackart
Registered Member
- May 13, 2009
- 61
- 10
if you only need the link look into the http traffic with a tool like http live headers for firefox. else analyze the javascript. do not miss the code on the second page, the page displays an iframe inside an iframe.
xenon2010
Regular Member
- Apr 27, 2010
- 233
- 49
you need to get the REAL url of the iFrame and then do further processing...
its not hard to break these kinds of protections.. all you need is Live Http Headers the firefox extension and you need to monitor what is really going on in this page. it needs some time to figure it out...
its not hard to break these kinds of protections.. all you need is Live Http Headers the firefox extension and you need to monitor what is really going on in this page. it needs some time to figure it out...
typeslowly
Registered Member
- Nov 30, 2008
- 64
- 11
View source to view the javascript.
He's basically doing some string manipulation & 'crypto' to determine which url to open in the iframe. Out of curiosity, how did you stumble upon this OP?
edit the function call
returns "9C206CB1A7B8B2BC/elif/moc.erahskcos.www//
tth"
Code:
var OHB = {
HKOzsD: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
HQOu: function (Zl) {
String.prototype.UkrBeyp = function () {
splitext = this.split("");
a = splitext.reverse();
b = a.join("");
return b;
}
var tNQt = "";
var xTx3476, Mhx7351, RJx7783;
var dTx9870, GWx8226, ezx5437, jvx5046;
var hUpvjDw = 0;
Zl = new String(Zl).replace(/\?\?\?/g, "=").trim().UkrBeyp().replace(/[^A-Za-z0-9\+\/\=]/g, "");
while (hUpvjDw < Zl.length) {
dTx9870 = this.HKOzsD.indexOf(Zl.charAt(hUpvjDw++));
GWx8226 = this.HKOzsD.indexOf(Zl.charAt(hUpvjDw++));
ezx5437 = this.HKOzsD.indexOf(Zl.charAt(hUpvjDw++));
jvx5046 = this.HKOzsD.indexOf(Zl.charAt(hUpvjDw++));
xTx3476 = (dTx9870 << 2) | (GWx8226 >> 4);
Mhx7351 = ((GWx8226 & 15) << 4) | (ezx5437 >> 2);
RJx7783 = ((ezx5437 & 3) << 6) | jvx5046;
tNQt = tNQt + String.fromCharCode(xTx3476);
if (ezx5437 != 64) {
tNQt = tNQt + String.fromCharCode(Mhx7351);
}
if (jvx5046 != 64) {
tNQt = tNQt + String.fromCharCode(RJx7783);
}
}
tNQt = new String(OHB.kQDjJn(tNQt)).UkrBeyp();
return tNQt;
},
kQDjJn: function (utftext) {
var string = "";
var i = 0;
var c = c1 = c2 = 0;
while (i < utftext.length) {
c = utftext.charCodeAt(i);
if (c < 128) {
string += String.fromCharCode(c);
i++;
} else if ((c > 191) && (c < 224)) {
c2 = utftext.charCodeAt(i + 1);
string += String.fromCharCode(((c & 31) << 6) | (c2 & 63));
i += 2;
} else {
c2 = utftext.charCodeAt(i + 1);
c3 = utftext.charCodeAt(i + 2);
string += String.fromCharCode(((c & 15) << 12) | ((c2 & 63) << 6) | (c3 & 63));
i += 3;
}
}
return string;
}
} /* jTgfYfHg9LXeOjOWuPQqpfVpO5BFX2PTaF5J2u5gOGNdRnWAah1K+oK32okqrTxCpc3GKmD+Zx9PSWuZ0VQSdw==*/
function ifReady() {
window.frames["ifr"].bla(OHB.HQOu("??????QODJDM2MkQxE0NChjQyI0QvUGbpZ2Lt92YuUmchh2crN2bz5yd3d3LvoDc0RHa"));
} <He's basically doing some string manipulation & 'crypto' to determine which url to open in the iframe. Out of curiosity, how did you stumble upon this OP?
edit the function call
Code:
OHB.HQOu("??????QODJDM2MkQxE0NChjQyI0QvUGbpZ2Lt92YuUmchh2crN2bz5yd3d3LvoDc0RHa"));returns "9C206CB1A7B8B2BC/elif/moc.erahskcos.www//
tth"
Last edited:
jokerfaces
Newbie
- Sep 7, 2011
- 15
- 2
its relly difficult
xenon2010
Regular Member
- Apr 27, 2010
- 233
- 49
basically download it with webpage control (with C#) the javascript in webpage control will translate this JS crap into HTML. so all you need is to get the innerHTML of the "body" or "document" out of it... you will get the iFrame data very easily.. then look for the url involved to process you to the downloading link.. etc.
