$30 off During Our Annual Pro Sale. View Details »

5文字で書くJavaScript/ Shibuya.XSS techtalk #10

5文字で書くJavaScript/ Shibuya.XSS techtalk #10

Shibuya.XSS techtalk #10 の発表資料です。

Masato Kinugawa

December 13, 2017
Tweet

More Decks by Masato Kinugawa

Other Decks in Technology

Transcript

  1. |>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>
    >|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>
    |>|>|>|>|>|>|>|>|>|>|>
    |>|>|>|>|>|>|>|>|>|>|>

    View Slide




  2. View Slide

  3. View Slide

  4. View Slide



  5. http://utf-8.jp/public/jjencode.html

    View Slide



  6. View Slide



  7. 0 1 2 3 4 5 6 7 8 9
    a b c d e f g h i j k l m n o p q r s t u v w x y z
    A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

    View Slide

  8. View Slide

  9. View Slide

  10. BANG!

    View Slide

  11. |>

    View Slide

  12. https://github.com/tc39/proposal-pipeline-operator
    The pipeline operator is essentially a useful syntactic
    sugar on a function call with a single argument.
    |>

    View Slide

  13. alert(1)

    View Slide

  14. 1 |> alert

    View Slide


  15. []()!+|>
    8-2=6

    View Slide


  16. [] !+|>
    6-1=5

    View Slide


  17. []+|>
    5

    View Slide




  18. View Slide

  19. View Slide



  20. View Slide

  21. > Function("alert(1)")
    < ƒ anonymous() {alert(1)}

    View Slide

  22. > Function("alert(1)")()
    OK

    View Slide

  23. > [].constructor

    View Slide

  24. > []["constructor"]

    View Slide

  25. > []["constructor"] === Array
    < true
    > []["constructor"]["constructor"] === Function
    < true

    View Slide

  26. > []["constructor"]["constructor"]("alert(1)")()
    OK

    View Slide

  27. > []["constructor"]["constructor"]("CODE")()

    View Slide

  28. > []["constructor"]["constructor"]("CODE")()

    View Slide

  29. > "CODE"|>[]["constructor"]["constructor"]
    > []["constructor"]["constructor"]("CODE")

    View Slide

  30. > []|>"CODE"|>[]["constructor"]["constructor"]
    > []["constructor"]["constructor"]("CODE")()

    View Slide

  31. exclaim(capitalize(doubleSay("hello")));
    "hello"
    |> doubleSay
    |> capitalize
    |> exclaim;

    View Slide

  32. > ("CODE"|>[]["constructor"]["constructor"])()

    View Slide

  33. > ["CODE"|>[]["constructor"]["constructor"]][0]()
    ( Expression ) [ Expression ][0]

    View Slide

  34. > []|>["CODE"|>[]["constructor"]["constructor"]][0]

    View Slide

  35. > []|>["CODE"|>[]["constructor"]["constructor"]][0]

    View Slide

  36. //JSFuckの基本型
    []["constructor"]["constructor"]("CODE")()
    //5文字JSの基本型
    []|>["CODE"|>[]["constructor"]["constructor"]][0]

    View Slide

  37. View Slide

  38. > +[]
    < 0

    View Slide

  39. > []>[]
    < false
    > [0]>[]
    < true

    View Slide

  40. > [][[]]
    < undefined

    View Slide

  41. > +[true][0]
    < 1
    > +[true][0]+[true][0]
    < 2
    > +[true][0]+[true][0]+[true][0]
    < 3
    > ...

    View Slide

  42. > [true][0]+[]
    < "true"
    > [false][0]+[]
    < "false"
    > [undefined][0]+[]
    < "undefined"

    View Slide

  43. > ["true"][0][0]
    < "t"
    > ["true"][0][1]
    < "r"
    > ["true"][0][2]
    < "u"

    View Slide

  44. > []|>["CODE"|>[]["constructor"]["constructor"]][0]

    View Slide

  45. > []["fill"]+[]
    < "function fill() { [native code] }"

    View Slide

  46. View Slide

  47. [[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[
    [+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]
    >[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+
    [[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>
    []][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+
    [[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]
    +[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]][+[]]+[[[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[
    [+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[
    ]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]]
    [+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]
    ]>[]]+[]][+[]][+[]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+
    [[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]
    ]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[
    ]][+[]]]+[[[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]]

    View Slide

  48. > []|>["alert(1)"|>[]["constructor"]["constructor"]][0]

    View Slide

  49. []|>[[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]
    ][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[[+[]]>[]]
    +[]][+[]][+[]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+
    []][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[
    [+[]]>[]][+[]]+[+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[+[[+[]]>[]][+[]]][+[]]+[[][[[[]>[]]+[]]
    [+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]
    ]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[+[[+[]]>[]][+[]
    ]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]|>[][[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]
    ]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[
    ]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+
    []][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>
    []][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[
    +[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[[]>[]]+
    []][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]][+[]]+[[[+[]]>[]]+[]][+[]][+
    [[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]
    ]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]
    ]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[
    [+[]]>[]]+[]][+[]][+[]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+
    [[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]
    ][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[
    [+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]]][[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]
    ][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]
    >[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]
    +[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]
    +[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[
    ]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[
    ]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]][+[]]+[[[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]]+[
    [[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]]
    [+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]
    >[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]]
    [+[]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][
    +[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]]
    [+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]]
    [+[[+[]]>[]][+[]]]]][+[]]

    View Slide

  50. []|>[[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]
    ][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[[+[]]>[]]
    +[]][+[]][+[]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+
    []][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[
    [+[]]>[]][+[]]+[+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[+[[+[]]>[]][+[]]][+[]]+[[][[[[]>[]]+[]]
    [+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]
    ]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[+[[+[]]>[]][+[]
    ]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]|>[][[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]
    ]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[
    ]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+
    []][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>
    []][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[
    +[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[[]>[]]+
    []][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]][+[]]+[[[+[]]>[]]+[]][+[]][+
    [[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]
    ]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]
    ]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[
    [+[]]>[]]+[]][+[]][+[]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+
    [[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]
    ][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[
    [+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]]][[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]
    ][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]
    >[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]
    +[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]
    +[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[
    ]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[]]+[]][+[]][+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[
    ]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]][+[]]+[[[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]]+[
    [[+[]]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]]
    [+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]
    >[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]]
    [+[]]+[[][[[[]>[]]+[]][+[]][+[]]+[[[[]>[]]+[]][+[]]+[][[]]][+[]][+[[+[]]>[]][+[]]+[+[]]]+[[[]>[]]+[]][+[]][
    +[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[]>[]]+[]][+[]][+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]]+[]][+[]][+[[+[]]>[]]
    [+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]+[[+[]]>[]][+[]]]+[[[+[]]>[]]+[]][+[]]
    [+[[+[]]>[]][+[]]]]][+[]]
    OK

    View Slide

  51. unescape("%u0051")

    View Slide

  52. https://syllab.fr/projets/experiments/xcharsjs/5chars.pipeline.
    html
    https://babeljs.io/repl/build/5099/#?babili=false&browsers=&
    build=&builtIns=false&code_lz=IwHwfAhgNgpgTgFyA&debug=f
    alse&circleciRepo=&evaluate=true&lineWrap=false&presets=st
    age-0&prettier=false&targets=&version=7.0.0-
    beta.2%2Bpr.6335

    View Slide



  53. View Slide

  54. |>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>
    >|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>|>

    View Slide