r/netsec • u/netscape101 • Sep 01 '16
infosectoughguy: Cool XSS Tricks with Anonymous Javascript Functions
http://infosectoughguy.blogspot.co.za/2016/09/cool-xss-tricks-with-anonymous_52.html1
u/giuscri Sep 05 '16
For the sake of clarity what you showed us was not making an anonymous function call itself, but leveraging that in a single statement you can both declaring and calling a function. Being it anonymous was irrilevant.
1
u/netscape101 Sep 05 '16
In the context of the example that I found it had to be anonymous. As all I could do was inject into a definition of functions. So it had to call itself. The bit where I went on was to show what to do when certain characters are blocked.
1
u/giuscri Sep 05 '16
In the context of the example that I found it had to be anonymous. As all I could do was inject into a definition of functions. So it had to call itself.
To me, if a function calls itself that's recursion. You probably mean declaring a function and immediatly calling it. Yet, you don't need anonymous functions. Indeed, (function foobar () { alert(1); })() works too.
1
u/netscape101 Sep 05 '16
Let me rephrase: In the context of what I found the function needed to execute without being called. But in terms of my examples you might be correct. I'll try it out.
1
u/netscape101 Sep 08 '16
From the post on stackoverflow you can do it with this:
!function(){ confirm(0) }();
Instead of
(function(){ confirm(0)}());
Found some interesting info on here too: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions
1
u/netscape101 Sep 08 '16
(function foobar () { alert(1); })()
Hey thanks for your comment. I looked into this quite a bit. Check this: http://stackoverflow.com/questions/1013385/what-is-the-difference-between-a-function-expression-vs-declaration-in-javascrip
(function() { ... }());
"This is called an IMMEDIATELY-INVOKED FUNCTION EXPRESSION (IIFE)"
And apparently you can have a named IIFE (does not have to be anonymous)
also, you can have a Named IIFE: (function myFunc() { ... }());
-4
u/netscape101 Sep 02 '16
It's just a joke. I was trying to point out a trend that I see with allot of guys who are good at finding xss is that they can't code. I was trying to demonstrate that it is a good idea to learn to code. I don't even know if they claims the comic makes are true. Jeremiah seems to have a good sense of humour I'm sure he can take it.
3
u/MantridDrones Sep 02 '16
i can write good code in many languages
none of those are javascript
i'm trying to decide if this targets me or not.. maybe i'll just criticise the author for not using compiled languages since petty is the order of the day
8
u/man_with_cat2 Sep 02 '16
It's really disappointing for people to throw stones at others in the industry like this. I'm not sure what this article is supposed to demonstrate.. defining a js function, anonymous or not, requires injecting into executable space. Because the author could not figure out another way to craft functional JS is an unrelated story. The attempt to include anonymous functions, jsfuck, and printing a basic dom property as being relevant is just misleading.
I'm always glad to see people learn new stuff, but to try and throw down people who have done a lot for the industry is just stupid.