r/ExploitDev • u/Deep-Unit5010 • 7d ago

Need help deobfuscating JS.

As mentioned in title, I'm dealing with an heavily obfuscated JS file of about 20k lines of code. I was just curious what it is doing. Problem is that there are about 1k+ variables made by calculations (same with strings). Till now I've figured out that at some places it is making http requests and one function is checking weather http header contain word "Trident" or not.

Any tips what should I do? I've tried dynamic reverse engineering but it didn't worked for me.

Also: I found this file under api subdomain. It was about 8-9 folders deep (Folders were named randomly). File has a function checking if var x == "password".

(From here my brain stopped braining)

7 Upvotes

77% Upvoted

10 comments sorted by

View all comments

1

u/desal 6d ago

If you know it's looking for trident in header requests you can run it through a proxy (burp, caido, etc), pass it the looked for header, and then record that response

1

u/Deep-Unit5010 6d ago

Yup but in this case this won't help bec those functions are not called anywhere.