Published 16 years 9 months ago • Last updated April 11, 2025 • ⏱️ 2 min read
This is a fun post about a feature I found in IE that allows you to do some crazy obfuscation. I'll start off with some simple examples:-
<img src=1 language=vbs onerror=msgbox+1> <img src=1 language=vbscript onerror=msgbox+1> <img src=1 onerror=vbs:msgbox+1>
So here we're not obfuscating but I'm showing how IE accepts the language attribute and a labelled vbs statement to change the event to allow vbscript instead of javascript. Ok so lets play a little ping pong:-
execScript("MsgBox 1","vbscript"); //executes vbs from js execScript('execScript "alert(1)","javascript"',"vbscript");
Look how we can call vbscript from javascript by using execScript and then look how we can execute from javascript to vbscript and then back to javascript again! So now we're playing some ping pong but how can we make our little game hidden?
<a href=# language="JScript.Encode" onclick="#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@">test</a>
Wait what? Yeah IE supports jscript.encode within the language attribute. Remember jscript.encode? ah the old ones are the best :) That's it right? Well....
<iframe onload=VBScript.Encode:#@~^CAAAAA==\ko$K6,FoQIAAA==^#~@>
Yeah you can use VBScript.Encode and Javascript.Encode as labels within an event! You might be going WTF right now and I can understand it because I did exactly the same but it would be silly to finish now without finishing our game of ping pong. How many rallies shall I do? I think 3 should be enough....
<body onload="jscript.encode:#@~^TAAAAA==nX+^UmMkwD`r:@$?73hzb)){'Z%QRG=2	V7WB qdG\:2jbebz)'{7:=@$J~E%km.kaOc+U1W9+J*CRcAAA==^#~@">
Ok so I go to:- jscript->jscript.encode->jscript.encode->jscript.encode->hex entities