we can expand our alphabet still further, and access some even more exciting properties:
[]["constructor"] --> function Array() { [native code] }
([]+[])["constructor"] --> function String() { [native code] }
(![])["constructor"] --> function Boolean() { [native code] }
(+[])["constructor"] --> function Number() { [native code] }
[]["filter"]["constructor"] --> function Function() { [native code] }
Almost there now.
By converting these back to strings we can access even more characters, and by passing the strings to the Function() constructor we can can construct functions and evaluate them! In other words, we have "eval". Let's use it to access the window object:
So now we have access to the global context and eval. We don't quite have access to the full range of letters, but we have enough letters to call toString, and use it's base conversion ability to get the full lowercase alphabet:
And now we have "p", we can use escape and unescape to get most of the rest:
unescape(escape(" ")[0]+4+0) --> "@"
So there you have it!
The source code essentially runs this process backwards: it repeatedly uses regular expressions to convert the code back into "()[]!+" one step at a time.
We start with [] and [[]].
convert [] to a boolean with !:
convert [] to undefined by subscripting it: convert [] [[]] and true to numbers by prefixing them with + and adding them with +: convert any of these to strings by prefixing them with []+ get individual characters with the array subscript operator: So now we can obtain a limited number of characters: which we can combine into strings with the + operator: It's not much, but it's enough to obtain large numbers: and, most importantly, to access a property of the array object: and by converting these back to a string: we can expand our alphabet still further, and access some even more exciting properties: Almost there now.By converting these back to strings we can access even more characters, and by passing the strings to the Function() constructor we can can construct functions and evaluate them! In other words, we have "eval". Let's use it to access the window object:
So now we have access to the global context and eval. We don't quite have access to the full range of letters, but we have enough letters to call toString, and use it's base conversion ability to get the full lowercase alphabet: And now we have "p", we can use escape and unescape to get most of the rest: So there you have it!The source code essentially runs this process backwards: it repeatedly uses regular expressions to convert the code back into "()[]!+" one step at a time.