Re: strange script in HTML format mail.

From: Dimitry Andric (dimat_private)
Date: Fri Apr 20 2001 - 10:50:48 PDT

  • Next message: Rui Seabra: "Re: Possible Overflow in ping, Linux?"

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    On 2001-04-20 at 08:29 Nicolas Villatte wrote:
    
    >I wonder what this code represents and how to decode and understand
    >it.
    
    It's nothing more than obfuscation of HTML code for a porn site
    spammer. It just adds 3 to the Unicode character code of each
    character in the string.
    
    You can see what the obfuscated stuff decodes to, by simply modifying
    the last few lines from:
    
      var s= Merlin( sJsCmds);
      document.write (s);
    
    to:
    
      var s= Merlin( sJsCmds);
      alert(s);
    
    Then you will get a page presenting you with an advertisement for the
    spammer's porn site. I must say that I've seen better obfuscation,
    though. :)
    
    Cheers,
    - --
    Dimitry Andric <dimat_private>
    PGP key: http://www.xs4all.nl/~dim/dim.asc
    KeyID: 4096/1024-0x2E2096A3
    Fingerprint: 7AB4 62D2 CE35 FC6D 4239 4FCD B05E A30A 2E20 96A3
    
    -----BEGIN PGP SIGNATURE-----
    Version: Encrypted with PGP Plugin for Calypso
    Comment: http://www.gn.apc.org/duncan/stoa_cover.htm
    
    iQA/AwUBOuBo5bBeowouIJajEQJlTQCdEurlJPPwRdS3tpvXUQBkXkhhbaMAoJX7
    yGGucC1V9d4Jm86MnswHooZf
    =1Svx
    -----END PGP SIGNATURE-----
    



    This archive was generated by hypermail 2b30 : Sat Apr 21 2001 - 11:54:50 PDT