TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Evading JavaScript anti-debugging techniques

236 点作者 hazebooth将近 2 年前

11 条评论

8chanAnon将近 2 年前
Interesting though it involves recompiling the web browser. I have encountered this issue on many websites and my response is to stream the website through a proxy server which can then save the content (both outgoing and incoming) to the local disk for analysis. Using the browser&#x27;s debugging tool is a lost cause when you&#x27;re dealing with obfuscated code. The approach that I use is to isolate the target JS, modify it by including calls to a websocket, save the code to disk and instruct the proxy server to load the code from disk instead of from the website. This way the website appears to work normally except with my modification. In some cases, it may be necessary to isolate an additional file or two due to dependencies.<p>The reason for the websocket is that the browser console is also rendered inoperable due to the debugger statements and console clear commands emanating from the website JS. A websocket is then the only way to transfer actionable information (such as a password or a secret link). It&#x27;s not an easy or quick process but, by inserting websocket calls in interesting places, it is possible to figure out what the JS is doing. It also helps a lot to prettify the JS in order to study it. There are websites that can do that for you. Unfortunately, the prettification of the JS may break it so you&#x27;re still stuck with doing the modifications in the original JS.<p>I built my own proxy server for this task but I imagine that the same may be possible with a tool like HTTP Toolkit but that means getting the Pro version.
评论 #36964387 未加载
评论 #36964902 未加载
评论 #36966345 未加载
评论 #36963603 未加载
评论 #36964828 未加载
jkingsman将近 2 年前
I&#x27;m surprised to not see Chrome&#x27;s handy &quot;Never pause here&quot; menu that appears when you right click any line of JS, including debug breakpoints. This is typically what I do when there&#x27;s a debug in an intervaled function (simple anti-debug commonly found on some video sites).<p>Example: <a href="https:&#x2F;&#x2F;i.imgur.com&#x2F;BsphnEu.png" rel="nofollow noreferrer">https:&#x2F;&#x2F;i.imgur.com&#x2F;BsphnEu.png</a>
评论 #36964412 未加载
评论 #36964917 未加载
评论 #36963700 未加载
gmerc将近 2 年前
Unfortunately that won’t be an option with Web Integrity….
评论 #36964915 未加载
TYT将近 2 年前
For people who don&#x27;t want to compile the anti-debugging firefox themselves, I have set up a github repo to do it automatically: <a href="https:&#x2F;&#x2F;github.com&#x2F;Sec-ant&#x2F;anti-anti-debugging-debugger-firefox">https:&#x2F;&#x2F;github.com&#x2F;Sec-ant&#x2F;anti-anti-debugging-debugger-fire...</a>
rasz将近 2 年前
&gt;By renaming it to something like &quot;banana,&quot; the debugger would no longer trigger on occurrences of the debugger keyword. To achieve this, we built customized version of Firefox.<p>heavy handed approach. I have some moderate success intercepting setInterval&#x2F;setTimeout and manually sifting to find that one call that starts the ball rolling. Things get old fast when the code you are looking at looks like<p><pre><code> 0[_0x199d1e(0x815*-0x2+0x1735+0x13f*-0x5)](_0x199d1e(0x3b3*0xa+0x1c1+-0x260d),_0x199d1e(0x2149*0x1+0x9f7+0x1*-0x29f5)))[_0x</code></pre>
29ebJCyy将近 2 年前
Just record a Replay (<a href="https:&#x2F;&#x2F;replay.io" rel="nofollow noreferrer">https:&#x2F;&#x2F;replay.io</a>). Done!
crazygringo将近 2 年前
&gt; <i>Once upon a time, whenever you tried to open your devtools on Supreme&#x27;s website, you found yourself trapped in a pesky debugger loop.</i><p>Could somebody here explain what that means, since the article doesn&#x27;t? What&#x27;s a debugger loop? What is the actual JavaScript code that somehow prevents debugging, and how does it accomplish that?
评论 #36963830 未加载
评论 #36963852 未加载
badrabbit将近 2 年前
The SANS course for this still teaches to use IE for debugging JS because it is the only browser that lets you break at arbitrary points in the code instead of newline boundaries.
评论 #36967060 未加载
38将近 2 年前
note if all you care about is capturing the web requests, you can use something like MITM Proxy:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;mitmproxy&#x2F;mitmproxy">https:&#x2F;&#x2F;github.com&#x2F;mitmproxy&#x2F;mitmproxy</a>
lini将近 2 年前
You can also use a MITM proxy tool to intercept the JS files and modify their response body to remove or replace the `debugger;` statements with something else. Might require inspecting the JS files first to see what needs to be replaced exactly, but should not take more than a few minutes.
评论 #36963499 未加载
评论 #36964844 未加载
评论 #36964141 未加载
ezekiel68将近 2 年前
Ah yes, the eternal arms race.