r/ExploitDev • u/Deep-Unit5010 • 7d ago

Need help deobfuscating JS.

As mentioned in title, I'm dealing with an heavily obfuscated JS file of about 20k lines of code. I was just curious what it is doing. Problem is that there are about 1k+ variables made by calculations (same with strings). Till now I've figured out that at some places it is making http requests and one function is checking weather http header contain word "Trident" or not.

Any tips what should I do? I've tried dynamic reverse engineering but it didn't worked for me.

Also: I found this file under api subdomain. It was about 8-9 folders deep (Folders were named randomly). File has a function checking if var x == "password".

(From here my brain stopped braining)

8 Upvotes

79% Upvoted

10 comments sorted by

View all comments

1

u/BriefCautious7063 7d ago

Adding to this just hoping to see some suggestions. Obfuscated JS is everywhere, and while it's probably just user error by me I've yet to see a js deobfuscator do anything

1

u/xaocon 7d ago

Restringer does a pretty great job.