Javascript with %%%%%%?


A

azwarking

Hi,

I had this guy post some spam to my site and now I'm on a mission to
find out who it is. He's got a site that redirects you elsewhere, in
that site I hit stop on the browser so I could see it. It contained
this script:

SCRIPT type='text/javascript'>
var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
%6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
%74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
%37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
%31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
%2f"+"%73%63%72%69p%74%3e";
document.writeln(unescape(ibnfbpy));
</SCRIPT

Is it just a redirecting script or something else?
 
Ad

Advertisements

O

Owen Jacobson

Hi,

I had this guy post some spam to my site and now I'm on a mission to
find out who it is.  He's got a site that redirects you elsewhere, in
that site I hit stop on the browser so I could see it.  It contained
this script:

SCRIPT type='text/javascript'>
var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
%6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
%74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
%37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
%31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
%2f"+"%73%63%72%69p%74%3e";
document.writeln(unescape(ibnfbpy));
</SCRIPT

Is it just a redirecting script or something else?

Wrong group; comp.lang.javascript is -thataway-> and has nothing to do
with Java. Followup-to set.

Those patterns are URL-escaped byte values representing some text,
followed by a short snippet of code to tell the javascript engine to
print the un-escaped version of the string on the page. The byte
values are probably ascii text; they're stored as pairs of hex digits,
with one byte per %AB sequence. Decoding it yourself should be fairly
trivial.

-o
 
S

Sabine Dinis Blochberger

azwarking said:
Hi,

I had this guy post some spam to my site and now I'm on a mission to
find out who it is. He's got a site that redirects you elsewhere, in
that site I hit stop on the browser so I could see it. It contained
this script:

SCRIPT type='text/javascript'>
var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
%6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
%74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
%37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
%31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
%2f"+"%73%63%72%69p%74%3e";
document.writeln(unescape(ibnfbpy));
</SCRIPT

Is it just a redirecting script or something else?
Please ask in comp.lang.javascript
 
D

Daniel Pitts

azwarking said:
Hi,

I had this guy post some spam to my site and now I'm on a mission to
find out who it is. He's got a site that redirects you elsewhere, in
that site I hit stop on the browser so I could see it. It contained
this script:

SCRIPT type='text/javascript'>
var ibnfbpy="%3c%73c%72%69pt%20"+""+"%74%79"+"p%65%3d%27%74ex"+"%74%2f
%6a%61%76%61s%63%72%69%70%74%27%3e%0a%77i%6ed%6f%77%2e%6c%6f%63a
%74%69%6fn%2e%68%72ef%3d%22%68t%74%70%"+"3a%2f%2f"+"%78%61%6e%61x
%37%37%37"+"%70%69%6c%6c%73%2e%63o%6d%2f%71%2eph%"+"70%3f%61%66f%3d
%31%26%71%3d%70%"+"68%65%6e%74"+"%65%72m%69ne%22%3b%0a%3c
%2f"+"%73%63%72%69p%74%3e";
document.writeln(unescape(ibnfbpy));
</SCRIPT

Is it just a redirecting script or something else?
While others have correctly pointed you to the proper newsgroup, I
happened to find the answer you need :)

Yes, the encoded the redirect into a obfuscated text.

It redirects to some spam site.
 
Ad

Advertisements

A

azwarking

While others have correctly pointed you to the proper newsgroup, I
happened to find the answer you need :)

Yes, the encoded the redirect into a obfuscated text.

It redirects to some spam site.

Thanks Daniel! LOL... big smile...
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top