[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F5JB3PDSPYSBC4FTCNVQW":3,"skill-same:01M71F5JB3PDSPYSBC4FTCNVQW":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M71F5JB3PDSPYSBC4FTCNVQW","obfuscation-javascript-exploit",null,"Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fobfuscation\u002Fjavascript\u002Fexploit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"obfuscation javascript exploit","javascript","obfuscation","exploit","sonnet","t1003","malware","flow","reveal","read","scripts","de","malicious","code","analysis","Bash","cybersecurity","eval","cm","t1566","2026-11-10 10:12:30",false,"---\nname: obfuscation-javascript-exploit\ndescription: Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- JavaScript\n- deobfuscation\n- web-malware\n- script-analysis\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1003\n- T1027\n- T1059\n- T1566\ncapec: []\n---\n\n# Deobfuscating JavaScript Malware\n\n## When to Use\n\n- Investigating a phishing page with obfuscated JavaScript that performs credential harvesting or redirect\n- Analyzing a web skimmer (Magecart-style) injected into an e-commerce site\n- Deobfuscating a JavaScript dropper that downloads and executes second-stage malware\n- Examining malicious email attachments containing HTML files with embedded obfuscated scripts\n- Analyzing browser exploit kits that use heavy JavaScript obfuscation to hide exploit delivery\n\n**Do not use** for obfuscated JavaScript that is merely minified production code; use a standard beautifier instead.\n\n## Prerequisites\n\n- Node.js 18+ installed for executing and debugging JavaScript in a controlled environment\n- Python 3.8+ with `jsbeautifier` library for code formatting\n- Browser developer tools (Chrome DevTools) for controlled execution in an isolated browser\n- CyberChef (https:\u002F\u002Fgchq.github.io\u002FCyberChef\u002F) for encoding\u002Fdecoding operations\n- de4js or JStillery for automated JavaScript deobfuscation\n- Isolated analysis VM with no access to production systems or sensitive data\n\n## Workflow\n\n### Step 1: Safely Extract and Examine the Obfuscated Script\n\nIsolate the malicious JavaScript without executing it:\n\n```bash\n# Extract JavaScript from HTML file\npython3 \u003C\u003C 'PYEOF'\nfrom html.parser import HTMLParser\n\nclass ScriptExtractor(HTMLParser):\n    def __init__(self):\n        super().__init__()\n        self.in_script = False\n        self.scripts = []\n        self.current = \"\"\n\n    def handle_starttag(self, tag, attrs):\n        if tag == \"script\":\n            self.in_script = True\n            self.current = \"\"\n\n    def handle_endtag(self, tag):\n        if tag == \"script\":\n            self.in_script = False\n            if self.current.strip():\n                self.scripts.append(self.current)\n\n    def handle_data(self, data):\n        if self.in_script:\n            self.current += data\n\nwith open(\"malicious_page.html\") as f:\n    parser = ScriptExtractor()\n    parser.feed(f.read())\n\nfor i, script in enumerate(parser.scripts):\n    with open(f\"script_{i}.js\", \"w\") as f:\n        f.write(script)\n    print(f\"Extracted script_{i}.js ({len(script)} bytes)\")\nPYEOF\n\n# Beautify the extracted JavaScript\nnpx js-beautify script_0.js -o script_0_pretty.js\n```\n\n### Step 2: Identify Obfuscation Techniques\n\nCategorize the obfuscation methods used:\n\n```\nCommon JavaScript Obfuscation Techniques:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nString Encoding:\n  - Hex encoding:          \"\\x68\\x65\\x6c\\x6c\\x6f\" -> \"hello\"\n  - Unicode escapes:       \"\\u0068\\u0065\\u006c\\u006c\\u006f\" -> \"hello\"\n  - Base64:                atob(\"aGVsbG8=\") -> \"hello\"\n  - charCodeAt\u002FfromCharCode: String.fromCharCode(104,101,108,108,111)\n  - Array-based lookup:    var _0x1234 = [\"hello\",\"world\"]; _0x1234[0]\n\nEval Chains:\n  - eval(atob(\"...\"))\n  - eval(unescape(\"...\"))\n  - new Function(\"return \" + decoded)()\n  - document.write(\"\u003Cscript>\" + decoded + \"\u003C\u002Fscript>\")\n  - setTimeout(decoded, 0)\n\nControl Flow:\n  - Switch-case dispatcher with shuffled case order\n  - Opaque predicates (always-true\u002Ffalse conditions)\n  - Dead code insertion\n  - Variable name mangling (_0x4a3b, _0xab12)\n\nAnti-Analysis:\n  - Debugger traps: setInterval(function(){debugger;}, 100)\n  - Console detection: overriding console.log\n  - Timing checks: performance.now() deltas\n  - DevTools detection: window.outerWidth - window.innerWidth > 100\n```\n\n### Step 3: Remove Anti-Analysis Protections\n\nNeutralize anti-debugging and anti-analysis traps:\n\n```javascript\n\u002F\u002F Remove debugger traps before analysis\n\u002F\u002F Replace in the obfuscated script:\n\n\u002F\u002F Before:\nsetInterval(function() { debugger; }, 100);\n\n\u002F\u002F After (neutralized):\nsetInterval(function() { \u002F* debugger removed *\u002F }, 100);\n\n\u002F\u002F Neutralize DevTools detection\n\u002F\u002F Before:\nif (window.outerWidth - window.innerWidth > 160) { window.location = \"about:blank\"; }\n\n\u002F\u002F After:\nif (false) { window.location = \"about:blank\"; }\n\n\u002F\u002F Neutralize timing checks\n\u002F\u002F Override performance.now to return consistent values\nconst originalNow = performance.now;\nperformance.now = function() { return 0; };\n```\n\n### Step 4: Decode String Obfuscation Layers\n\nProgressively decode encoded strings:\n\n```python\n# Python script to decode common JS obfuscation patterns\nimport re\nimport base64\nimport urllib.parse\n\ndef decode_hex_strings(code):\n    \"\"\"Replace \\\\xNN sequences with ASCII characters\"\"\"\n    def hex_replace(match):\n        hex_str = match.group(0)\n        try:\n            return bytes.fromhex(hex_str.replace(\"\\\\x\", \"\")).decode(\"ascii\")\n        except:\n            return hex_str\n    return re.sub(r'(?:\\\\x[0-9a-fA-F]{2})+', hex_replace, code)\n\ndef decode_unicode_escapes(code):\n    \"\"\"Replace \\\\uNNNN sequences with characters\"\"\"\n    def unicode_replace(match):\n        return chr(int(match.group(1), 16))\n    return re.sub(r'\\\\u([0-9a-fA-F]{4})', unicode_replace, code)\n\ndef decode_charcode_arrays(code):\n    \"\"\"Resolve String.fromCharCode calls\"\"\"\n    def charcode_replace(match):\n        codes = [int(c.strip()) for c in match.group(1).split(\",\")]\n        return '\"' + \"\".join(chr(c) for c in codes) + '\"'\n    return re.sub(r'String\\.fromCharCode\\(([0-9,\\s]+)\\)', charcode_replace, code)\n\ndef decode_base64_strings(code):\n    \"\"\"Resolve atob() calls with static strings\"\"\"\n    def atob_replace(match):\n        try:\n            decoded = base64.b64decode(match.group(1)).decode(\"utf-8\")\n            return f'\"{decoded}\"'\n        except:\n            return match.group(0)\n    return re.sub(r'atob\\([\"\\']([A-Za-z0-9+\u002F=]+)[\"\\']\\)', atob_replace, code)\n\n# Apply all decoders\nwith open(\"script_0.js\") as f:\n    code = f.read()\n\ncode = decode_hex_strings(code)\ncode = decode_unicode_escapes(code)\ncode = decode_charcode_arrays(code)\ncode = decode_base64_strings(code)\n\nwith open(\"script_0_decoded.js\", \"w\") as f:\n    f.write(code)\nprint(\"Decoded strings written to script_0_decoded.js\")\n```\n\n### Step 5: Resolve Eval Chains Safely\n\nUnwrap eval\u002FFunction constructor chains without executing:\n\n```javascript\n\u002F\u002F Node.js script to safely resolve eval chains\n\u002F\u002F Run in isolated environment: node --experimental-vm-modules deobfuscate.js\n\nconst vm = require('vm');\n\n\u002F\u002F Create sandboxed context with logging\nconst sandbox = {\n    eval: function(code) {\n        console.log(\"=== EVAL INTERCEPTED ===\");\n        console.log(code.substring(0, 500));\n        console.log(\"========================\");\n        return code; \u002F\u002F Return the code instead of executing it\n    },\n    document: {\n        write: function(html) {\n            console.log(\"=== DOCUMENT.WRITE INTERCEPTED ===\");\n            console.log(html.substring(0, 500));\n        },\n        getElementById: function() { return { innerHTML: \"\" }; }\n    },\n    window: { location: { href: \"\" } },\n    atob: function(s) { return Buffer.from(s, 'base64').toString(); },\n    unescape: unescape,\n    setTimeout: function(fn) { if (typeof fn === 'string') console.log(\"TIMEOUT CODE:\", fn); },\n    console: console,\n    String: String,\n    Array: Array,\n    parseInt: parseInt,\n    RegExp: RegExp,\n};\n\nconst context = vm.createContext(sandbox);\n\n\u002F\u002F Load and execute the obfuscated script in sandbox\nconst fs = require('fs');\nconst code = fs.readFileSync('script_0.js', 'utf8');\n\ntry {\n    vm.runInContext(code, context, { timeout: 5000 });\n} catch(e) {\n    console.log(\"Execution error (expected):\", e.message);\n}\n```\n\n### Step 6: Analyze the Deobfuscated Payload\n\nExamine the revealed malicious logic:\n\n```\nDeobfuscated Malware Categories and IOC Extraction:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCredential Harvester:\n  - Form action URLs (exfiltration endpoints)\n  - XMLHttpRequest\u002Ffetch destinations\n  - Targeted input field names (username, password, cc_number)\n\nWeb Skimmer (Magecart):\n  - Payment form overlay injection\n  - Card data exfiltration URLs\n  - Keylogger event listeners (onkeypress, oninput)\n\nRedirect Script:\n  - Destination URLs in location.href assignments\n  - Conditional redirects based on user-agent or referrer\n  - Cloaking logic (show benign content to bots)\n\nExploit Kit Landing:\n  - Browser\u002Fplugin version checks\n  - Exploit payload URLs\n  - Shellcode embedded as arrays or encoded strings\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Eval Chain** | Nested layers of eval(), Function(), or document.write() calls that each decode one layer of obfuscation before passing to the next |\n| **String Array Rotation** | Obfuscation technique storing all strings in a shuffled array and accessing them by computed index to hide string literals |\n| **Dead Code Insertion** | Adding non-functional code blocks that never execute to increase analysis complexity and confuse pattern matching |\n| **Opaque Predicate** | Conditional expression whose outcome is predetermined but difficult to determine statically; used to obscure control flow |\n| **Anti-Debugging** | JavaScript techniques to detect and thwart browser DevTools or debugger usage including debugger statements and timing checks |\n| **Web Skimmer** | Malicious JavaScript injected into e-commerce sites to steal payment card data from checkout forms (Magecart attack) |\n\n## Tools & Systems\n\n- **CyberChef**: GCHQ's web-based tool for encoding\u002Fdecoding transformations useful for unwinding multi-layer obfuscation\n- **de4js**: Online JavaScript deobfuscator supporting common obfuscation tools (obfuscator.io, JScrambler)\n- **Node.js VM Module**: Sandboxed JavaScript execution environment for safely evaluating obfuscated code with intercepted APIs\n- **Chrome DevTools**: Browser developer tools for stepping through JavaScript execution with breakpoints and console access\n- **JSDetox**: JavaScript malware analysis tool providing execution emulation and deobfuscation\n\n## Common Scenarios\n\n### Scenario: Deobfuscating a Magecart Web Skimmer\n\n**Context**: A compromised e-commerce site has obfuscated JavaScript injected into its checkout page. The script needs deobfuscation to identify the data exfiltration endpoint and determine what customer data was stolen.\n\n**Approach**:\n1. Extract the injected script from the page source (often appended to a legitimate JS file or loaded from an external domain)\n2. Beautify the code and identify the obfuscation technique (typically string array + rotation + hex encoding)\n3. Decode string encoding layers (hex -> Unicode -> base64) using the Python decoder script\n4. Resolve the string array by evaluating the array definition and rotation function\n5. Identify the form targeting logic (querySelector for payment form fields)\n6. Extract the exfiltration URL from the XMLHttpRequest or fetch call\n7. Document stolen data fields and exfiltration endpoint for incident response\n\n**Pitfalls**:\n- Executing obfuscated scripts on a connected system (the script may phone home during analysis)\n- Not removing anti-debugging traps before using browser DevTools (infinite debugger loops)\n- Missing additional obfuscation layers loaded dynamically from external URLs\n- Overlooking base64-encoded inline images or data URIs that may contain additional scripts\n\n## Output Format\n\n```\nJAVASCRIPT MALWARE DEOBFUSCATION REPORT\n=========================================\nSource:           checkout.js (injected into example-shop.com)\nObfuscation:      obfuscator.io (string array + rotation + hex encoding)\nLayers Removed:   3\n\nOBFUSCATION TECHNIQUES IDENTIFIED\n[1] String array with 247 entries, rotated by 0x1a3\n[2] Hex-encoded string references (\\x68\\x65\\x6c\\x6c\\x6f)\n[3] Base64-wrapped eval chain (2 layers)\n[4] Anti-debugging: setInterval debugger trap\n\nDEOBFUSCATED FUNCTIONALITY\nType:             Magecart Payment Card Skimmer\nTarget Forms:     input[name*=\"card\"], input[name*=\"cc_\"]\nData Captured:    Card number, expiration, CVV, cardholder name\nExfil Method:     POST via XMLHttpRequest\nExfil URL:        hxxps:\u002F\u002Fanalytics-cdn[.]com\u002Fcollect\nExfil Format:     JSON { \"cn\": card_number, \"exp\": expiry, \"cv\": cvv }\nTrigger:          Form submit event on checkout page\n\nEXTRACTED IOCs\nDomains:          analytics-cdn[.]com\nIPs:              185.220.101[.]42\nURLs:             hxxps:\u002F\u002Fanalytics-cdn[.]com\u002Fcollect\n                  hxxps:\u002F\u002Fanalytics-cdn[.]com\u002Fgate.js\n```\n","# Deobfuscating JavaScript Malware\n\n## When to Use\n\n- Investigating a phishing page with obfuscated JavaScript that performs credential harvesting or redirect\n- Analyzing a web skimmer (Magecart-style) injected into an e-commerce site\n- Deobfuscating a JavaScript dropper that downloads and executes second-stage malware\n- Examining malicious email attachments containing HTML files with embedded obfuscated scripts\n- Analyzing browser exploit kits that use heavy JavaScript obfuscation to hide exploit delivery\n\n**Do not use** for obfuscated JavaScript that is merely minified production code; use a standard beautifier instead.\n\n## Prerequisites\n\n- Node.js 18+ installed for executing and debugging JavaScript in a controlled environment\n- Python 3.8+ with `jsbeautifier` library for code formatting\n- Browser developer tools (Chrome DevTools) for controlled execution in an isolated browser\n- CyberChef (https:\u002F\u002Fgchq.github.io\u002FCyberChef\u002F) for encoding\u002Fdecoding operations\n- de4js or JStillery for automated JavaScript deobfuscation\n- Isolated analysis VM with no access to production systems or sensitive data\n\n## Workflow\n\n### Step 1: Safely Extract and Examine the Obfuscated Script\n\nIsolate the malicious JavaScript without executing it:\n\n```bash\n# Extract JavaScript from HTML file\npython3 \u003C\u003C 'PYEOF'\nfrom html.parser import HTMLParser\n\nclass ScriptExtractor(HTMLParser):\n    def __init__(self):\n        super().__init__()\n        self.in_script = False\n        self.scripts = []\n        self.current = \"\"\n\n    def handle_starttag(self, tag, attrs):\n        if tag == \"script\":\n            self.in_script = True\n            self.current = \"\"\n\n    def handle_endtag(self, tag):\n        if tag == \"script\":\n            self.in_script = False\n            if self.current.strip():\n                self.scripts.append(self.current)\n\n    def handle_data(self, data):\n        if self.in_script:\n            self.current += data\n\nwith open(\"malicious_page.html\") as f:\n    parser = ScriptExtractor()\n    parser.feed(f.read())\n\nfor i, script in enumerate(parser.scripts):\n    with open(f\"script_{i}.js\", \"w\") as f:\n        f.write(script)\n    print(f\"Extracted script_{i}.js ({len(script)} bytes)\")\nPYEOF\n\n# Beautify the extracted JavaScript\nnpx js-beautify script_0.js -o script_0_pretty.js\n```\n\n### Step 2: Identify Obfuscation Techniques\n\nCategorize the obfuscation methods used:\n\n```\nCommon JavaScript Obfuscation Techniques:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nString Encoding:\n  - Hex encoding:          \"\\x68\\x65\\x6c\\x6c\\x6f\" -> \"hello\"\n  - Unicode escapes:       \"\\u0068\\u0065\\u006c\\u006c\\u006f\" -> \"hello\"\n  - Base64:                atob(\"aGVsbG8=\") -> \"hello\"\n  - charCodeAt\u002FfromCharCode: String.fromCharCode(104,101,108,108,111)\n  - Array-based lookup:    var _0x1234 = [\"hello\",\"world\"]; _0x1234[0]\n\nEval Chains:\n  - eval(atob(\"...\"))\n  - eval(unescape(\"...\"))\n  - new Function(\"return \" + decoded)()\n  - document.write(\"\u003Cscript>\" + decoded + \"\u003C\u002Fscript>\")\n  - setTimeout(decoded, 0)\n\nControl Flow:\n  - Switch-case dispatcher with shuffled case order\n  - Opaque predicates (always-true\u002Ffalse conditions)\n  - Dead code insertion\n  - Variable name mangling (_0x4a3b, _0xab12)\n\nAnti-Analysis:\n  - Debugger traps: setInterval(function(){debugger;}, 100)\n  - Console detection: overriding console.log\n  - Timing checks: performance.now() deltas\n  - DevTools detection: window.outerWidth - window.innerWidth > 100\n```\n\n### Step 3: Remove Anti-Analysis Protections\n\nNeutralize anti-debugging and anti-analysis traps:\n\n```javascript\n\u002F\u002F Remove debugger traps before analysis\n\u002F\u002F Replace in the obfuscated script:\n\n\u002F\u002F Before:\nsetInterval(function() { debugger; }, 100);\n\n\u002F\u002F After (neutralized):\nsetInterval(function() { \u002F* debugger removed *\u002F }, 100);\n\n\u002F\u002F Neutralize DevTools detection\n\u002F\u002F Before:\nif (window.outerWidth - window.innerWidth > 160) { window.location = \"about:blank\"; }\n\n\u002F\u002F After:\nif (false) { window.location = \"about:blank\"; }\n\n\u002F\u002F Neutralize timing checks\n\u002F\u002F Override performance.now to return consistent values\nconst originalNow = performance.now;\nperformance.now = function() { return 0; };\n```\n\n### Step 4: Decode String Obfuscation Layers\n\nProgressively decode encoded strings:\n\n```python\n# Python script to decode common JS obfuscation patterns\nimport re\nimport base64\nimport urllib.parse\n\ndef decode_hex_strings(code):\n    \"\"\"Replace \\\\xNN sequences with ASCII characters\"\"\"\n    def hex_replace(match):\n        hex_str = match.group(0)\n        try:\n            return bytes.fromhex(hex_str.replace(\"\\\\x\", \"\")).decode(\"ascii\")\n        except:\n            return hex_str\n    return re.sub(r'(?:\\\\x[0-9a-fA-F]{2})+', hex_replace, code)\n\ndef decode_unicode_escapes(code):\n    \"\"\"Replace \\\\uNNNN sequences with characters\"\"\"\n    def unicode_replace(match):\n        return chr(int(match.group(1), 16))\n    return re.sub(r'\\\\u([0-9a-fA-F]{4})', unicode_replace, code)\n\ndef decode_charcode_arrays(code):\n    \"\"\"Resolve String.fromCharCode calls\"\"\"\n    def charcode_replace(match):\n        codes = [int(c.strip()) for c in match.group(1).split(\",\")]\n        return '\"' + \"\".join(chr(c) for c in codes) + '\"'\n    return re.sub(r'String\\.fromCharCode\\(([0-9,\\s]+)\\)', charcode_replace, code)\n\ndef decode_base64_strings(code):\n    \"\"\"Resolve atob() calls with static strings\"\"\"\n    def atob_replace(match):\n        try:\n            decoded = base64.b64decode(match.group(1)).decode(\"utf-8\")\n            return f'\"{decoded}\"'\n        except:\n            return match.group(0)\n    return re.sub(r'atob\\([\"\\']([A-Za-z0-9+\u002F=]+)[\"\\']\\)', atob_replace, code)\n\n# Apply all decoders\nwith open(\"script_0.js\") as f:\n    code = f.read()\n\ncode = decode_hex_strings(code)\ncode = decode_unicode_escapes(code)\ncode = decode_charcode_arrays(code)\ncode = decode_base64_strings(code)\n\nwith open(\"script_0_decoded.js\", \"w\") as f:\n    f.write(code)\nprint(\"Decoded strings written to script_0_decoded.js\")\n```\n\n### Step 5: Resolve Eval Chains Safely\n\nUnwrap eval\u002FFunction constructor chains without executing:\n\n```javascript\n\u002F\u002F Node.js script to safely resolve eval chains\n\u002F\u002F Run in isolated environment: node --experimental-vm-modules deobfuscate.js\n\nconst vm = require('vm');\n\n\u002F\u002F Create sandboxed context with logging\nconst sandbox = {\n    eval: function(code) {\n        console.log(\"=== EVAL INTERCEPTED ===\");\n        console.log(code.substring(0, 500));\n        console.log(\"========================\");\n        return code; \u002F\u002F Return the code instead of executing it\n    },\n    document: {\n        write: function(html) {\n            console.log(\"=== DOCUMENT.WRITE INTERCEPTED ===\");\n            console.log(html.substring(0, 500));\n        },\n        getElementById: function() { return { innerHTML: \"\" }; }\n    },\n    window: { location: { href: \"\" } },\n    atob: function(s) { return Buffer.from(s, 'base64').toString(); },\n    unescape: unescape,\n    setTimeout: function(fn) { if (typeof fn === 'string') console.log(\"TIMEOUT CODE:\", fn); },\n    console: console,\n    String: String,\n    Array: Array,\n    parseInt: parseInt,\n    RegExp: RegExp,\n};\n\nconst context = vm.createContext(sandbox);\n\n\u002F\u002F Load and execute the obfuscated script in sandbox\nconst fs = require('fs');\nconst code = fs.readFileSync('script_0.js', 'utf8');\n\ntry {\n    vm.runInContext(code, context, { timeout: 5000 });\n} catch(e) {\n    console.log(\"Execution error (expected):\", e.message);\n}\n```\n\n### Step 6: Analyze the Deobfuscated Payload\n\nExamine the revealed malicious logic:\n\n```\nDeobfuscated Malware Categories and IOC Extraction:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCredential Harvester:\n  - Form action URLs (exfiltration endpoints)\n  - XMLHttpRequest\u002Ffetch destinations\n  - Targeted input field names (username, password, cc_number)\n\nWeb Skimmer (Magecart):\n  - Payment form overlay injection\n  - Card data exfiltration URLs\n  - Keylogger event listeners (onkeypress, oninput)\n\nRedirect Script:\n  - Destination URLs in location.href assignments\n  - Conditional redirects based on user-agent or referrer\n  - Cloaking logic (show benign content to bots)\n\nExploit Kit Landing:\n  - Browser\u002Fplugin version checks\n  - Exploit payload URLs\n  - Shellcode embedded as arrays or encoded strings\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Eval Chain** | Nested layers of eval(), Function(), or document.write() calls that each decode one layer of obfuscation before passing to the next |\n| **String Array Rotation** | Obfuscation technique storing all strings in a shuffled array and accessing them by computed index to hide string literals |\n| **Dead Code Insertion** | Adding non-functional code blocks that never execute to increase analysis complexity and confuse pattern matching |\n| **Opaque Predicate** | Conditional expression whose outcome is predetermined but difficult to determine statically; used to obscure control flow |\n| **Anti-Debugging** | JavaScript techniques to detect and thwart browser DevTools or debugger usage including debugger statements and timing checks |\n| **Web Skimmer** | Malicious JavaScript injected into e-commerce sites to steal payment card data from checkout forms (Magecart attack) |\n\n## Tools & Systems\n\n- **CyberChef**: GCHQ's web-based tool for encoding\u002Fdecoding transformations useful for unwinding multi-layer obfuscation\n- **de4js**: Online JavaScript deobfuscator supporting common obfuscation tools (obfuscator.io, JScrambler)\n- **Node.js VM Module**: Sandboxed JavaScript execution environment for safely evaluating obfuscated code with intercepted APIs\n- **Chrome DevTools**: Browser developer tools for stepping through JavaScript execution with breakpoints and console access\n- **JSDetox**: JavaScript malware analysis tool providing execution emulation and deobfuscation\n\n## Common Scenarios\n\n### Scenario: Deobfuscating a Magecart Web Skimmer\n\n**Context**: A compromised e-commerce site has obfuscated JavaScript injected into its checkout page. The script needs deobfuscation to identify the data exfiltration endpoint and determine what customer data was stolen.\n\n**Approach**:\n1. Extract the injected script from the page source (often appended to a legitimate JS file or loaded from an external domain)\n2. Beautify the code and identify the obfuscation technique (typically string array + rotation + hex encoding)\n3. Decode string encoding layers (hex -> Unicode -> base64) using the Python decoder script\n4. Resolve the string array by evaluating the array definition and rotation function\n5. Identify the form targeting logic (querySelector for payment form fields)\n6. Extract the exfiltration URL from the XMLHttpRequest or fetch call\n7. Document stolen data fields and exfiltration endpoint for incident response\n\n**Pitfalls**:\n- Executing obfuscated scripts on a connected system (the script may phone home during analysis)\n- Not removing anti-debugging traps before using browser DevTools (infinite debugger loops)\n- Missing additional obfuscation layers loaded dynamically from external URLs\n- Overlooking base64-encoded inline images or data URIs that may contain additional scripts\n\n## Output Format\n\n```\nJAVASCRIPT MALWARE DEOBFUSCATION REPORT\n=========================================\nSource:           checkout.js (injected into example-shop.com)\nObfuscation:      obfuscator.io (string array + rotation + hex encoding)\nLayers Removed:   3\n\nOBFUSCATION TECHNIQUES IDENTIFIED\n[1] String array with 247 entries, rotated by 0x1a3\n[2] Hex-encoded string references (\\x68\\x65\\x6c\\x6c\\x6f)\n[3] Base64-wrapped eval chain (2 layers)\n[4] Anti-debugging: setInterval debugger trap\n\nDEOBFUSCATED FUNCTIONALITY\nType:             Magecart Payment Card Skimmer\nTarget Forms:     input[name*=\"card\"], input[name*=\"cc_\"]\nData Captured:    Card number, expiration, CVV, cardholder name\nExfil Method:     POST via XMLHttpRequest\nExfil URL:        hxxps:\u002F\u002Fanalytics-cdn[.]com\u002Fcollect\nExfil Format:     JSON { \"cn\": card_number, \"exp\": expiry, \"cv\": cvv }\nTrigger:          Form submit event on checkout page\n\nEXTRACTED IOCs\nDomains:          analytics-cdn[.]com\nIPs:              185.220.101[.]42\nURLs:             hxxps:\u002F\u002Fanalytics-cdn[.]com\u002Fcollect\n                  hxxps:\u002F\u002Fanalytics-cdn[.]com\u002Fgate.js\n```\n",{"name":5,"tags":44,"capec":49,"model":23,"tools":50,"domain":35,"maxTurns":54,"nist_csf":55,"subdomain":60,"description":7,"mitre_attack":61},[25,45,46,47,48],"JavaScript","deobfuscation","web-malware","script-analysis",[],[51,34,52,53],"Read","Glob","Grep",20,[56,57,58,59],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","malware-analysis",[62,63,64,65],"T1003","T1027","T1059","T1566","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fobfuscation\u002Fjavascript\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill obfuscation-javascript-exploit",{"tool":79,"command":80},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill obfuscation-javascript-exploit",{"tool":82,"command":83},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill obfuscation-javascript-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fobfuscation\u002Fjavascript\u002Fexploit\u002FSKILL.md",true,[87],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"index.json","REFERENCE","参考文档",705,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fobfuscation\u002Fjavascript\u002Fexploit\u002Findex.json",[94,117,136,157,179,195],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,102,103,104,105,30,37,106,107,108,109,110,111,112,113,114,115,35,116],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[22,101,124,104,125,126,127,35,34,33,128,129,130,131,30,132,133,28,134,135],"services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[143,144,145,146,147,148,35,34,149,33,150,151,30,28,152,153,154,155,156,23],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[102,164,165,166,167,168,169,37,170,35,116,171,172,173,174,175,176,177,178,30],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[186,187,102,188,166,168,189,37,190,170,35,116,33,191,192,193,194,178,30,106],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[202,102,166,203,189,37,204,205,35,116,206,207,208,209,210,211,30,106,212,213],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]