View source for JSFuck

{{Short description|Esoteric programming language}}
'''JSFuck''' is an [[esolang|esoteric]] [[subset]] of [[JavaScript]], where [[code]] is written using only six [[character (symbol)|character]]s: <code>[</code>, <code>]</code>, <code>(</code>, <code>)</code>, <code>!</code>, and <code>+</code>.  The name is derived from [[Brainfuck]], an esoteric programming language that also uses a minimalistic [[Alphabet (formal languages)|alphabet]] of only [[punctuation]]. Unlike Brainfuck, which requires its own [[compiler]] or [[Interpreter (computing)|interpreter]], JSFuck is valid JavaScript code, meaning that JSFuck programs can be run in any [[web browser]] or [[JavaScript engine|engine]] that interprets JavaScript. JSFuck is able to recreate all JavaScript functionality using such a limited set of characters because JavaScript allows the evaluation of any expression as any type.<ref>Jane Bailey/[[The Daily WTF]]: "Bidding on Security". http://thedailywtf.com/articles/bidding-on-security</ref>

== History ==
In July 2009, Yosuke Hasegawa created a web application called jjencode which could encode arbitrary JavaScript into an obfuscated form utilizing only the 18 symbols <code>[]()!+,\"$.:;_{}~=</code>.<ref>{{cite web |url=http://utf-8.jp/public/jjencode.html |title=jjencode - Encode any JavaScript program using only symbols |website=utf-8.jp |last=Hasegawa |first=Yosuke |url-status=live |archive-url=https://web.archive.org/web/20090715022126/http://utf-8.jp/public/jjencode.html |archive-date=2009-07-15 |date=2009-07-10 |access-date=2017-10-25}}</ref><ref>{{cite web |url=http://utf-8.jp/ |title=UTF-8.jp ''[2009-07-28]'' |website=utf-8.jp |last=Hasegawa |first=Yosuke |url-status=live |archive-url=https://web.archive.org/web/20090728092939/http://utf-8.jp/ |archive-date=2009-07-28 |date=July 2009 |access-date=2017-10-25 }}</ref>  In January 2010, an informal competition was held in the "Obfuscation" forum of the sla.ckers.org web application security site to come up with a way to get the minimum number of characters required down to less than eight: <code>[]()!+,/</code>.  Contributors to the thread managed to eliminate the need for the <code>,</code> and <code>/</code> characters.<ref>{{cite web |url=http://sla.ckers.org/forum/read.php?24,32930 |title=Yet Another Useless Contest (but fun!) Less chars needed to run arbitrary JS code |website=sla.ckers.org |url-status=dead |archive-url=https://web.archive.org/web/20110301054929/http://sla.ckers.org/forum/read.php?24,32930 |archive-date=2011-03-01 |date=2010-01-14 |access-date=2017-10-25}}</ref>  As of March 2010, an online encoder called JS-NoAlnum was available which utilized only the final set of six characters.<ref>{{cite web |url=http://discogscounter.getfreehosting.co.uk/js-noalnum_com.php |title=js-noalnum_com.php |website=discogscounter.getfreehosting.co.uk |url-status=dead |archive-url=https://web.archive.org/web/20100301190117/http://discogscounter.getfreehosting.co.uk/js-noalnum_com.php |archive-date=2010-03-01 |access-date=2017-10-25}}</ref> By the end of 2010, Hasegawa made a new encoder available named JSF*ck which also used only the minimum six characters.<ref>{{cite web |url=http://utf-8.jp/public/jsfuck.html |title=JSF*ck - []()!+ |website=utf-8.jp |last=Aiko |first=Kenji |archive-url=https://web.archive.org/web/20101201115501/http://utf-8.jp/public/jsfuck.html |archive-date=2010-12-01 |date=November 2010 |access-date=2017-10-25}}</ref><ref>{{cite web |url=http://utf-8.jp/ |title=UTF-8.jp ''[2010-11-30]'' |website=utf-8.jp |last=Hasegawa |first=Yosuke |url-status=live |archive-url=https://web.archive.org/web/20101130145703/http://utf-8.jp/ |archive-date=2010-11-30 |date=November 2010 |access-date=2017-10-25 }}</ref>  In 2012, Martin Kleppe created a "jsfuck" project on [[GitHub]],<ref>{{cite web |last=Kleppe |first=Martin |date=2012-07-16 |title=Commits · aemkei/jsfuck |url=https://github.com/aemkei/jsfuck/commits/main?after=6b7e2e9ef44941e028ddf16a793a6c8902da2ae3+139 |accessdate=2017-10-25 |website=github.com}}</ref> and a JSFuck.com website with a web app using that implementation of the encoder.<ref>{{cite web |url=http://toolbar.netcraft.com/site_report?url=http%3A%2F%2Fwww.jsfuck.com%2F |title=Site report for www.jsfuck.com |website=toolbar.netcraft.com |last=Kleppe |first=Martin |date=September 2012 |accessdate=2017-10-25}}</ref>

JSFuck can be used to bypass detection of [[malicious code]] submitted on [[website]]s, e.g. in [[cross-site scripting]] (XSS) attacks.<ref name="ArsTechnica 2016 eBay">{{cite web|url=https://arstechnica.com/security/2016/02/ebay-has-no-plans-to-fix-severe-bug-that-allows-malware-distribution/|title=eBay has no plans to fix "severe" bug that allows malware distribution [Updated]|work=Ars Technica|author=Dan Goodin|date=3 February 2016}}</ref> Another potential use of JSFuck lies in [[code obfuscation]].  An optimized version of JSFuck has been used to encode [[jQuery]], a [[JavaScript library]], into a fully functional version written with just the six characters.<ref>https://github.com/fasttime/jquery-screwed jQuery JavaScript library made of only six different characters: ! ( ) + [ ]</ref>

== Encoding methods ==
JSFuck code is extremely "verbose": In JavaScript, the code <code>alert("[[Hello World!]]")</code>, which causes a [[modal window|pop-up]] window to open with the text "Hello world", is 21 characters long. In JSFuck, the same code has a length of 4325 characters.<ref>{{cite web |title=JScrewIt |url=https://jscrew.it/ |website=JScrewIt |access-date=13 June 2021}}</ref> Certain single characters require far more than 1000 characters when expanded as JSFuck. This section offers an overview of how this expansion works.

=== Numbers ===
The number 0 is created by <code>+[]</code>, where <code>[]</code> is the empty [[array data structure|array]] and <code>+</code> is the [[JavaScript syntax#Arithmetic|unary plus]], used to [[Type conversion|convert]] the right side to a numeric value (zero here).
The number 1 is formed as <code>+!![]</code> or <code>+!+[]</code>, where the [[Boolean data type|boolean]] value <code>true</code> (expressed as <code>!![]</code> or <code>!+[]</code> in JSFuck) is converted into the numeric value 1 by the prepended plus sign.
The digits 2 to 9 are formed by summing <code>true</code> the appropriate number of times. E.g. in JavaScript <code>true + true</code> = 2 and <code>true</code> = <code>!![]</code> = <code>!+[]</code>, hence 2 can be written as <code>!![]+!![]</code> or <code>!+[]+!+[]</code>. Other digits follow a similar pattern.
Integers consisting of two or more digits are written, as a string, by [[Concatenation|concatenating]] 1-digit arrays with the plus operator.
For example, the string <code>"10"</code> can be expressed in JavaScript as <code>[1] + [0]</code>.
By replacing the digits with the respective JSFuck expansions, this yields <code>[+!+[]]+[+[]]</code>.
To get a numeric value instead of a string, one would enclose the previous expression in parentheses or square brackets and prepend a plus, yielding <code>10</code> = <code>+([+!+[]]+[+[]])</code>.

=== Letters ===
Some letters can be obtained in JSFuck by accessing single characters in the string representations of simple boolean or numeric values like <code>"false"</code>, <code>"true"</code>, <code>"NaN"</code>, <code>"undefined"</code> with an ''indexer'' (a number in square brackets). Other tricks are needed to produce other letters – for example by casting the string <code>1e1000</code> into a number, which gives <code>Infinity</code>, which in turn makes the letter <code>y</code> accessible.<ref>http://patriciopalladino.com/blog/2012/08/09/non-alphanumeric-javascript.html "Brainfuck Beware: JavaScript is after you!"</ref>

The following is a list of primitive values used as building blocks to produce the most simple letters.

:{| class="wikitable"
! Value || JSFuck
|-
| <code>false</code> || <code>![]</code>
|-
| <code>true</code> || <code>!![]</code> or <code>!+[]</code>
|-
| <code>NaN</code> || <code>+[![]]</code>
|-
| <code>undefined</code> || <code>[][[]]</code>
|-
| <code>Infinity</code> || <code>+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+[+!+[]]+[+[]]+[+[]]+[+[]])</code>
|}

==== Example: Creating the letter "a" ====
<code>"a"</code>: Taken from the string <code>"false"</code>. The second character of "false" is a, which can be accessed with:
# <code>"false"[1]</code>. <code>"false"</code> can be made from <code>false+[]</code>, i.e. the boolean constant false plus an empty array.
# <code>(false+[])[1]</code>: We write false as <code>![]</code> (negation applied to an empty array).
# <code>(![]+[])[1]</code>: 1 is a number, we can write it as <code>+true</code>.
# <code>(![]+[])[+true]</code>: Since false is <code>![]</code>, true is <code>!![]</code>.
# <code>(![]+[])[+!![]]</code> – which evaluates to "a".
Proof: In JavaScript, <code>alert((![]+[])[+!![]])</code> does the same as <code>alert("a")</code>.<ref>Adapted from: https://esolangs.org/wiki/JSFuck</ref>

=== Other constructs ===
The <code>Function</code> [[constructor (object-oriented programming)|constructor]] can be used to trigger execution of JavaScript code contained in a string as if it were native JavaScript. So, for example, the statement <code>alert(1)</code> is equivalent to <code>Function("alert(1)")()</code>. The <code>Function</code> constructor can be retrieved in JSFuck by accessing the ''constructor'' property of a well known function, such as <code>[]["filter"]</code> (<code>Array.prototype.filter</code>) or <code>[]["flat"]</code> (<code>Array.prototype.flat</code>) in modern browsers. And then <code>alert(1)</code> becomes <code>[]["flat"]["constructor"]("alert(1)")()</code>.

== Character table ==

The characters with the shortest JSFuck expansions are listed below. Other [[UTF-8]] characters can be expressed as well but will generate considerably longer code.

:{| class="wikitable"
! Character || JSFuck
|-
|style="text-align: center;" | <code>+</code> || <code>(+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+[+!+[]]+[+[]]+[+[]])+[])[!+[]+!+[]]</code>
|-
|style="text-align: center;" | <code>.</code> || <code>(+(+!+[]+[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]])+[])[+!+[]]</code>
|-
|style="text-align: center;" | <code>0</code> || <code>+[]</code>
|-
|style="text-align: center;" | <code>1</code> || <code>+!![]</code><br />or <code>+!+[]</code>
|-
|style="text-align: center;" | <code>2</code> || <code>!![]+!![]</code><br />or <code>!+[]+!+[]</code>
|-
|style="text-align: center;" | <code>3</code> || <code>!![]+!![]+!![]</code><br />or <code>!+[]+!+[]+!+[]</code>
|-
|style="text-align: center;" | <code>4</code> || <code>!![]+!![]+!![]+!![]</code><br />or <code>!+[]+!+[]+!+[]+!+[]</code>
|-
|style="text-align: center;" | <code>5</code> || <code>!![]+!![]+!![]+!![]+!![]</code><br />or <code>!+[]+!+[]+!+[]+!+[]+!+[]</code>
|-
|style="text-align: center;" | <code>6</code> || <code>!![]+!![]+!![]+!![]+!![]+!![]</code><br />or <code>!+[]+!+[]+!+[]+!+[]+!+[]+!+[]</code>
|-
|style="text-align: center;" | <code>7</code> || <code>!![]+!![]+!![]+!![]+!![]+!![]+!![]</code><br />or <code>!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]</code>
|-
|style="text-align: center;" | <code>8</code> || <code>!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]</code><br />or <code>!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]</code>
|-
|style="text-align: center;" | <code>9</code> || <code>!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]</code><br />or <code>!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]</code>
|-
|style="text-align: center;" | <code>a</code> || <code>(![]+[])[+!+[]]</code>
|-
|style="text-align: center;" | <code>c</code> || <code>([]+[][(![]+[])[+!![]]+(!![]+[])[+[]]])[!![]+!![]+!![]]</code>
|-
|style="text-align: center;" | <code>d</code> || <code>([][[]]+[])[!+[]+!+[]]</code>
|-
|style="text-align: center;" | <code>e</code> || <code>(!![]+[])[!+[]+!+[]+!+[]]</code>
|-
|style="text-align: center;" | <code>f</code> || <code>(![]+[])[+[]]</code>
|-
|style="text-align: center;" | <code>i</code> || <code>([![]]+[][[]])[+!+[]+[+[]]]</code>
|-
|style="text-align: center;" | <code>I</code> || <code>(+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+(+!+[])+(+[])+(+[])+(+[]))+[])[+[]]</code>
|-
|style="text-align: center;" | <code>l</code> || <code>(![]+[])[!+[]+!+[]]</code>
|-
|style="text-align: center;" | <code>N</code> || <code>(+[![]]+[])[+[]]</code>
|-
|style="text-align: center;" | <code>n</code> || <code>([][[]]+[])[+!+[]]</code>
|-
|style="text-align: center;" | <code>o</code> || <code>(!![]+[][(![]+[])[+!![]]+(!![]+[])[+[]]])[+!![]+[+[]]]</code>
|-
|style="text-align: center;" | <code>r</code> || <code>(!+[]+[])[+!+[]]</code>
|-
|style="text-align: center;" | <code>s</code> || <code>(![]+[])[!+[]+!+[]+!+[]]</code>
|-
|style="text-align: center;" | <code>t</code> || <code>(!+[]+[])[+[]]</code>
|-
|style="text-align: center;" | <code>u</code> || <code>([][[]]+[])[+[]]</code>
|-
|style="text-align: center;" | <code>y</code> || <code>(+[![]]+[+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+(+!+[])+(+[])+(+[])+(+[]))])[+!+[]+[+[]]]</code>
|}

== Security ==
Lacking the distinct features of "usual" JavaScript, obfuscation techniques like JSFuck can assist malicious JavaScript code in bypassing intrusion prevention systems<ref name="medina">Ré Medina,  Matías A. (2012-09). Bypassing WAFs with non-alphanumeric XSS. Retrieved from http://blog.infobytesec.com/2012/09/bypassing-wafs-with-non-alphanumeric-xss.html.</ref> or content filters. For instance, the lack of alphanumeric characters in JSFuck and a flawed content filter allowed sellers to embed arbitrary JSFuck scripts in their eBay auction pages.<ref name="ArsTechnica 2016 eBay" />

== See also ==
* [[Brainfuck]] - an esoteric programming language created in 1993 by Urban Müller.<ref>{{Cite journal|last=Easter|first=Brandee|date=2020-04-02|title=Fully Human, Fully Machine: Rhetorics of Digital Disembodiment in Programming|journal=Rhetoric Review|volume=39|issue=2|pages=202–215|doi=10.1080/07350198.2020.1727096|s2cid=219665562|issn=0735-0198}}</ref>

== References ==
{{Reflist}}

== External links ==
* [http://www.jsfuck.com/ JSFuck - Write any JavaScript with 6 Characters: [&#93;()!+] – web application for encoding JavaScript to JSFuck
* [https://github.com/aemkei/jsfuck/blob/master/jsfuck.js JavaScript code of the aforementioned converter]
* [https://github.com/fasttime/JScrewIt JScrewIt] - Another tool to convert JavaScript to JSFuck, with [https://github.com/fasttime/JScrewIt/blob/master/Features.md environment-specific optimizations]
* [https://esolangs.org Esolang] - The esoteric programming languages wiki 
{{JavaScript}}
[[Category:Esoteric programming languages]]
[[Category:JavaScript]]
{{Esoteric programming languages}}