Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #27287 > unrolled thread

JavaScript Packer + Password Protection

Back to article view | Back to comp.lang.javascript

Contents

  JavaScript Packer + Password Protection MASTER TROLL BAIT <0ntariokingston@gmail.com> - 2015-04-09 15:52 -0700
    Re: JavaScript Packer + Password Protection MASTER TROLL BAIT <0ntariokingston@gmail.com> - 2015-04-09 22:22 -0700
      Re: JavaScript Packer + Password Protection Andreas Bergmaier <andber93@web.de> - 2015-04-14 00:47 +0200
    Re: JavaScript Packer + Password Protection Dave Brown <0ntariokingston@gmail.com> - 2015-05-18 18:36 -0700

#27287 — JavaScript Packer + Password Protection

http://www.scriptcompress.com/scrambler.htm is a tool I made to kind of encrypt text (similar to ROT13 but only uses characters uses in your password) and JavaScript scripts. The pass word is never included in the script so it cannot be hacked or even unpacked!

When a script is run, a prompt will request a password.

I will be making it so the password field can be a domain name, so script will make sure it is on right site before it can run.

Please give comments about how to make this too better.

Hateful Trolls need not reply!

[toc] | [next] | [standalone]

#27291

On Thursday, April 9, 2015 at 6:52:34 PM UTC-4, MASTER TROLL BAIT wrote:
> http://www.scriptcompress.com/scrambler.htm is a tool I made to kind of encrypt text (similar to ROT13 but only uses characters uses in your password) and JavaScript scripts. The pass word is never included in the script so it cannot be hacked or even unpacked!
> 
> When a script is run, a prompt will request a password.
> 
> I will be making it so the password field can be a domain name, so script will make sure it is on right site before it can run.
> 
> Please give comments about how to make this too better.
> 
> Hateful Trolls need not reply!

Now you can use the full page URL as password, but the password prompt has been replaced by a check of the pages web address and it is used for the password, so now the JavaScript will only run from that exact URL or the page will fail! You can also use the subdomain (like www) and/or domain (like site.com) so the script will run throughout your website.

[toc] | [prev] | [next] | [standalone]

#27369

MASTER TROLL BAIT schrieb:
> On Thursday, April 9, 2015 at 6:52:34 PM UTC-4, MASTER TROLL BAIT wrote:
>> […]
 >>
 >> The pass word is never included in the script so it cannot be hacked 
or even unpacked!
>
> Now you can use the full page URL as password, but the password prompt has been replaced by a check of the pages web address and it is used for the password, so now the JavaScript will only run from that exact URL or the page will fail!

You're contradicting yourself here. The password might not be included 
in the script code itself, but it is an intrinsic property of the 
resource you are trying to protect. Everybody who accesses your script 
does know your domain.

And yes, it can be trivially unpacked. Just open the console on that 
page that uses the script, paste the script there and replace 
`this[__]($$)` (in the end) by `console.log($$)`. Hit enter and the 
"decrypted" code is printed.

  Bergi

[toc] | [prev] | [next] | [standalone]

#27754

http://www.scriptcompress.com/scrambler.htm has a few different ways to protect your code and make it harder to see code. Please show actual samples if any issues.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web