Discussion on question by Jens Renders: JSF**k with only 5 symbols?

« first day next day → last day (38 days later) »

jimmy23013

00:17

[[].concat].find("".concat)(1)[0] almost works in Firefox 3.6. But it didn't have the find function yet.

Jens Renders

00:28

@CatsAreFluffy one will do

No I'm mistaking

1 hour later…

jimmy23013

01:38

Anyone using MS Edge?

Lynn

I have Edge right here!

Chrome can’t handle that, either. Hm.

But for a different reason

I don’t know much about differences in JS implementations across browsers. :(

Actually, probably the same reason, nevermind.

jimmy23013

So my approach doesn't seem to work anywhere. If we had window, we could get [object Window], then window.atob and most of the letters.

Lynn

What do you expect [[].concat].find("".concat) to be?

jimmy23013

01:54

If a browser supports Array.prototype.find, and doesn't set strict mode for native functions, it should return window.

Then we can get [object Window] and window.atob, and most of the letters.

Older browsers when there wasn't the strict mode, usually doesn't have [].find.

CatsAreFluffy

02:52

Hey, can we please not mess around with ancient browsers...

Vihan

@CatsAreFluffy this is PPCG though, isn't it? :P

jimmy23013

03:08

[[].concat].find("".concat) should be just Array.prototype.concat with the object reference removed. concat(1)[0] returns window.

(If there is no strict mode.)

CatsAreFluffy

03:33

Oops, I forgot for a moment...

1 hour later…

Sp3000

04:57

@CatsAreFluffy Technically + as well, but that's even less useful than - :P

12 hours later…

Easterly Irk

17:09

= would also be good.

CatsAreFluffy

17:28

Maybe. But Assuming[we have window] what can we do?

Jens Renders

window["div"]+[]

for example

it returns "function div(e){return $("<div/>").addClass(e)}"

which has the letters r and s so we could make constructor

doesn't work in firefox though, but there ar many options with window

CatsAreFluffy

17:50

And C for fromCharCode, but we still need mh

Jens Renders

window["$"]+[] returns "function (a,b){return new e.fn.init(a,b,h)}" which contains h an much more

once we have window it's really easy

CatsAreFluffy

What bout $?

I'm working on making constructor assuming window.

CatsAreFluffy

18:25

The code for v fails in my browser.

CatsAreFluffy

18:38

And plus window.div is undefined for me.

In chrome 48

Or just find l and steal window.eval.

CatsAreFluffy

18:59

This is the closest I've gotten:

window[([][[]]+[])[++[++[++[+[]][+[]]][+[]]][+[]]]+([][([][[]]+[])[++[++[++[++[‌+[]][+[]]][+[]]][+[]]][+[]]]+([][[]]+[])[++[++[++[++[++[+[]][+[]]][+[]]][+[]]][+[‌]]][+[]]]+([][[]]+[])[++[+[]][+[]]]+([][[]]+[])[++[++[+[]][+[]]][+[]]]]+[])[(++[+‌+[++[++[++[++[+[]][+[]]][+[]]][+[]]][+[]]][+[]]][+[]])+(++[++[++[++[++[++[+[]][+[‌]]][+[]]][+[]]][+[]]][+[]]][+[]])+(++[++[++[++[++[++[+[]][+[]]][+[]]][+[]]][+[]]]‌[+[]]][+[]])+(++[++[++[++[++[+[]][+[]]][+[]]][+[]]][+[]]][+[]])]++[][[]]+[][++[+[‌]][+[]]]+"l"]

1 hour later…

Jens Renders

20:00

well $ comes from the string that div returns

I'm in chrome 48 too, on mac and windows, both works

jimmy23013

@CatsAreFluffy
window["a"+"t"+"o"+(window+[])[2]]("c"+"u"+"a"+"a")[0] -> r
window["a"+"t"+"o"+(window+[])[2]]("c"+"y"+"a"+"a")[0] -> s

1 hour later…

CatsAreFluffy