Nested JavaScript Obfuscation - GuidePoint Security CTF Challenge

To help support me, check out Kite! Kite is a coding assistant that helps you faster, on any IDE offer smart completions and documentation. www.kite.com/g... (disclaimer, affiliate link) Hang with our community on Discord! johnhammond.or...
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
E-mail: [e-mail]
PayPal: paypal.me/johnh...
GitHub: github.com/Joh...
Site: www.johnhammond...
Twitter: / _johnhammond

[@_JohnHammond]

Rewatching this for the premiere, I see the Dcode.fr output does include the rest of the octal number, but due to a newline it cut it into a second part. Apparently, I had not realized that while recording. PLZ 4GIVE MEH

[@user-lk5qz4wx4q]

F

[@oskrm]

Hey John, How can I participate in this CTF?

[@0x8badf00d]

The subscript appears to be the base.

[@sumedhvangara7368]

"challenge challenge in the challenge category, nice"

[@somebodystealsmyname]

Hey John, your bash is still hard to get used to :D cat $file | grep 'eval' >/dev/null if [ $? -eq 0 ] then This piece of code contains at least 3 things shellsheck will not accept (SC2086, SC2002 and SC2181) :D The "best" syntax would be: if grep -q eval "$file" then Netherless, great video!

[@naheelazawy]

came for this. Also I guess I should mention piping sed to sed. It works, but it was possible to have both in one sed command separated by a semicolon

[@willkessner2674]

Man it was so refreshing when you used Bash, I’m normally wayyy over my head in these videos, and the most advanced stuff I’ve done has been mostly in Bash. But when you used that “cat | grep” I physically went “nooo” because I actually knew abt grep’s input file option. Not saying that you made a grave mistake or anything, it was just awesome to finally, after watching so many of these videos, actually know what the heck was going on lol

[@chriss8825]

I got hired to code a basic custom CMS for a client, so I had archived the wordpress junk. Turns out wordpress had been hacked and a very similar Javascript backdoor was installed (think it only had two layers of obfuscation). Although I had lots of fun reverse engineering it, it's scary that it took years for anyone to detect it with their security automated scans.

[@nathanpalmer2931]

I think your octal problem had to do with the tool not working properly. A single octal number is 3 bits in binary, which doesn't align itself very well with the normal 8 bits per byte. The reason the rotate worked, is it realined the bits to the correct positions. If the tool you had used properly prepended the 0 bit(s) in the correct place to begin with, I think you would have had the answer right away, but because you were using math functions that doesn't care about byte boundaries, you ended up in this situation.

[@fabiancostamoling]

thank you (: magical speakin' as always... clear and trying to teach :)

[@Jimfowler82]

Learning loads John thank you, lost my interest with computers with windows. Back in the game and loving Linux and learning networking/hacking. Having fun just playing with binaries and working out what they do , learning python after doing 68000 assembly and some c++ in past. I love working in the terminal & just having the tools/environment I want not what gets put onto me. Back in the day late 90s I started using netbus on my friends computers for fun. Naughty I know but we all did it to each other in the end 😜. I worked with the maker of netbus on future releases before he moved onto other things. I never took to windows which put me of computing. Now I’m back more mature and like a child excited to learn more & be a good boy now days lol

[@Riccardo4106]

What about the other IPs in the final script? And why you decided to focus on that number instead of follow the GET request to the given IPs?

[@bruh_5555]

I feel John is getting attacked by some MITM because first his certificate failed then his proxy failed too

[@septim8312]

Great content, great premiere! Thank you :)

[@Zaakipaladin]

I don't know what's going on, but I can tell its awesome.

[@XiSparks]

Great video as always!

[@deyeop5944]

Hey i just wanted to ask , what are some commands shortcut that u use very often and how spilt your terminal so easily? Love your content btw.

[@yumbuboyumbubo8230]

I think he uses Terminator.

[@Jimfowler82]

Have you moved to zsh? I’ve started using it and really enjoy the customise nature of it with all the plugins and tools.

[@rishavsharma1500]

Hip hip hurre....!!!🤗

[@robertwouda]

Very cool

[@gen0ne]

I admire you

[@hallgowrt]

try int(num_in_quotes, 8) ... I used this to convert to other bases

[@LapisOnTheMoon]

algorithm time ;D good video

[@guiguicdd]

[@ARZ10198]

I watched it late but here's your comment

[@mattplaygamez]

Can you please do the Madness room from Tryhackme

[@navjotsingh2169]

How to get invite from defcon please explain it

[@РоманВавилов-ш6й]

05:35 Javascript is compiled not interpreted

[@_JohnHammond]

No, I believe JavaScript is a scripting language, and is interpreted..

[@LESLEYYY0]

Very confident it's interpreted. Unless a part of the code is executed thousands of times over, then the js JIT compiler will compile that part to speed things up

[@РоманВавилов-ш6й]

Found out it depends on the actual runtime environment, in case of nodejs seems like it parses the code and interprets it, but like chromes engine uses jit compiler

[@Este44fr]

@@РоманВавилов-ш6й NodeJS uses V8, which is the chrome engine