While working on frontend security projects, I encountered Javascript - here's what I learned.

Found this helpful? Share it with your team and leave a comment below!

正文

Sometimes when working on scraping some website you look into JavaScript code and it looks

like a complete mess that is impossible to read - no matter how much you squint, you cannot

make sense of it. That’s because it has been obfuscated. Code obfuscation is a transformation

that is meant to make code difficult to read and reverse engineer. Many web sites utilize

JavaScript obfuscation to make things difficult to scraper/automation developers.

Consider the following very trivial Javascript statement:

We will discuss various ways it can be obfuscated. To make things clear, we will go through

one obfuscation technique at a time and provide an example of how each technique changes this

code in a form that is meant to be unreadable. However, it should be noted that typically

multiple obfuscation methods are being utilized in scraping-resistant websites.

We will experiment with some online tools that obfuscate the JS code. Hexadecimal string encoding

and switch off all checkboxes but “Encode Strings” the obfuscated code will look like this:

"\x48\x65\x6C\x6C\x6F\x2C\x20\x77\x6F\x72\x6C\x64\x21\x20"

Each ASCII character of the hardcoded string was converted into hexadecimal form, as can be

verified with calculator in programmers mode. This is commonly done, but is pretty weak

More Details

There are a few more points worth noting. First, browser compatibility varies across different browsers. Second, performance optimization is crucial when handling large amounts of data. Finally, key management is also an important consideration.

That's all for this comprehensive guide. I hope you found it helpful! Feel free to leave comments if you have questions.

Reference: Javascript obfuscation techniques by example – Trickster Dev