Javascript HTML Cloak/Hide Source

well php is a server side code... javascript is a client side... if you want to hide something, do it on serverside... if you encrypted your client side code it's not hidden, anybody can decrypt it

but if you don't know what's the difference between server side code or a client side code, or how the webservers works, I guess don't working with cloaking technics.

cloaking need some knowledge, and you have to clearly understand the basics, after test your solution on your test enviorement.

aftershock2020 said:

WorkingDog,

Actually, you can't read ' anything ' in the browser, as php doesn't send ' through ' the browsers, it only reflects the content from the server-side but as it doesn't come through the browser itself in full text format, you can NOT see php code in the browser by even firebug or any other non-standard practices.

If you hack the server, where the files are stored, sure, you can rip every file out of there with no issue but that still has nothing to do with the browser and php, as that would be a full hack and not just a view source issue.

Here is a link showing an example of what I'm talking about:

http://php.about.com/od/troubleshooting/qt/view_source.htm

You can't see php code in a standard browser, it is impossible, as the code is designed for working server-side commands to build the content within the broswer without revealing the actual processing data itself.

You guys may be mistaking the content of exposed html and javascript links that haven't been properly concealed but, you won't see any of the php wrapped code, as it ' doesn't come through the broswer ' , which is why it builds faster uploads of pages when you go to a php site vs. an html page. It processes the data on the server-side and not within the broswer/on the page itself.

It's php 101 stuff, man. Like I've said before, check this stuff out yourselves by actual trial in the field.

Click to expand...

Yes, like I've said, you cannot see the actual RAW PHP code. (I bold this because you've argued against a point that I have agreed with you on repeatedly...)

However, anything PHP prints/outputs that makes it's way to the browser, regardless of where it is stored on the server, will be able to be seen in the client source, if not other method. That's where encoding comes in--it makes it hard to see the actions you send to the client because they're heavily encoded and take a good deal of work to pry out.

I think we're having an issue of mismatched terminology on our ends. You think I'm saying one thing, I think you're saying something else.

for educational purposes.

encoding != encryption. encoding is just changing of data from 1 form to another and can easily be decoded.

encryption goes through mathematical algorithm to change the content. the only way to decrypt it is to know the secret key that is used during the encryption.

security facts: anything that is seating on the client side (pc, mac, your iphone) are considered insecure. anybody with too much free time and enough security knowledge will be able to break anything that is stored in the client side.

obfuscation is not encryption. it is merely encoding so to speak.

javascript can be used to encrypt data but it takes too much processing resources. and furthermore, even if you use javascript for client-side encryption, it is a waste of time. because the secure key has to be used by the client-site javascript to decrypt. which means there is no secret in the first place.

you can only make things harder for the adversary to look into what you have. go for javascript obfuscation if it really is so much to your concern to hide your stuff.

whatever drkenneth have mentioned, is correct. read what that man say.

one more thing, base64 is encoding. not encryption. and gzip is compression, not encoding nor encryption.

another thing to add, careful on cloaking. don't forget google created chrome. they can easily use the chrome javascript engine on backend to obtain the generated source and compare against what the google bot sees. this will easily detect cloaking activities.