[RESOLVED] nead a trick?

[Zpixel]

i wrote some javascripts and need some trick to prevent others download them completely. i think there can be a way to do so, shuch as writing some php scripts?

[NogDog]

For JavaScript to run, it must be downloaded to the browser. Therefore it cannot be "hidden", just as the HTML it is embedded in cannot be "hidden". It can be obfuscated to make it hard to read, but it still has to be valid JS code that the browser can read, and thus any competent JS programmer will be able to read it too, if s/he really wants to.

[Zpixel]

after hours of trying i made a trick. you can go to www.iranbookmaster.com
from two links below that page click on the left one. in the next page, try to save it,if sombody can.

if you succeed please inform me.

[Weedpacket]

Zpixel wrote:

if you succeed please inform me.

To what are you referring? On tunnel.php there's a form with a hidden field named "box" and a value of "signinAllowed". The form is immediately submitted using JavaScript. That submits to bookmaster.php, which just sends back (invalid) HTML to refresh the page back to the index.

But that form submission is the only JavaScript I can find. So unless there's some more that you've hidden....

Edit: just tried something else in case I missed something, and it's since been changed so that if the user-agent string doesn't contain "MSIE" it comes up with a "Please use MSIE" message (I'd rather take my business elsewhere). Still, easy enough to fix: change the user-agent string so that it includes "MSIE". Still can't find any "hidden" JavaScript, though. Which I guess is the point.

[leatherback]

what do you mean 'Please use IE'? You LIKE bugs?

[leatherback]

What function was so special?

<!-- Begin
text = "&#1583;&#1585;&#1575;&#1740;&#1606; &#1602;&#1587;&#1605;&#1578; &#1575;&#1587;&#1705;&#1585;&#1740;&#1662;&#1578; &#1607;&#1575;&#1740; &#1705;&#1575;&#1585;&#1576;&#1585;&#1583;&#1740; &#1580;&#1575;&#1608;&#1575; &#1602;&#1585;&#1575;&#1585; &#1583;&#1575;&#1585;&#1583;&#1548; &#1575;&#1740;&#1606; &#1575;&#1587;&#1705;&#1585;&#1740;&#1662;&#1578; &#1607;&#1575; &#1705;&#1575;&#1605;&#1604;&#1575;&#1611; &#1607;&#1608;&#1588;&#1605;&#1606;&#1583; &#1608; &#1580;&#1575;&#1604;&#1576; &#1607;&#1587;&#1578;&#1606;&#1583;.   &#1576;&#1607; &#1593;&#1606;&#1608;&#1575;&#1606; &#1605;&#1579;&#1575;&#1604; &#1605;&#1740; &#1578;&#1608;&#1575;&#1606;&#1740;&#1583; &#1575;&#1591;&#1604;&#1575;&#1593;&#1575;&#1578; &#1605;&#1578;&#1608;&#1575;&#1604;&#1740; &#1608; &#1605;&#1582;&#1585;&#1576;/3&#1607;&#1605; &#1582;&#1608;&#1583; &#1585;&#1575; &#1575;&#1740;&#1606;&#1711;&#1608;&#1606;&#1607; &#1576;&#1607; &#1606;&#1605;&#1575;&#1740;&#1588; &#1576;&#1711;&#1584;&#1575;&#1585;&#1740;&#1583; &#1578;&#1575; &#1578;&#1608;&#1580;&#1607; &#1588;&#1606;&#1608;&#1606;&#1583;&#1711;&#1575;&#1606;/8&#1576;&#1740;&#1606;&#1606;&#1583;&#1711;&#1575;&#1606; &#1585;&#1575; &#1576;&#1607; &#1582;&#1608;&#1583; &#1580;&#1604;&#1576; &#1705;&#1606;&#1583;."
word = text.split(' ')
i = -1;           //letter count
j = 0;            //which word in array is to be spelled
start = 0;      //variable to hold cycles of the blink
scount = 0;  //variable to hold cycles of the mispell
function checkIt() {
with(document.all.anima) {
if(innerText.charAt(innerText.length-1) == "_") {
innerText = innerText.substring(0, innerText.length - 1);
return true;
}
else {
innerText = innerText + "_";
return false;
      }
   }
}
function blinkfor(count, timing) {
with(document.all.anima) {
if(start < count) {
if(checkIt()) {
start++;
}
mistake = 'blinkfor('+count+','+timing+')';
setTimeout('eval(mistake)', timing);
}
else {
start = 0;
i++;
call_It();
      }
   }
}
function mispell(offset,correction) {
with(document.all.anima) {
if(scount < offset) {
if(!checkIt()) {
innerText = innerText.substring(0, innerText.length-2) + "_";
scount++;
}
mistake = 'mispell(' + offset + ', "' + correction + '")';
setTimeout("eval(mistake)", 150);
}
else {
if(correction == '' && scount == offset ) {
i = i - offset;
scount++;
}
if(offset > 0) {
if(checkIt()) {
innerText += correction.charAt(correction.length - offset) + "_";
offset--;
}
mistake = 'mispell(' + offset + ',"' + correction + '")';
setTimeout("eval(mistake)", 150);
}
else {
scount = 0;
j++;
innerText = innerText.substring(0, innerText.length - 1);
call_It();
         }
      }
   }
}
function spellit(string) {
with(document.all.anima) {
if(i <= string.length) {
if(string.charAt(i) == '/') {
NumErrs = string.charAt(i + 1);
NewLets = string.substring(i + 2, i + NumErrs);
mispell(NumErrs,NewLets);
}
else if(i <= string.length - 1) {
i++;
innerText = string.substring(0,i) + "_";
mistake = 'spellit("' + string + '")';
setTimeout("eval(mistake)", 150);
}
else {
innerText = string.substring(0, i);
j++;
call_It();
         }
      }
   }
}
function call_It() {
with(document.all) {
if(i == -1){
blinkfor(4, 150);
}
else if(j <= word.length - 1) {
spellit(anima.innerText + " " + word[j]);
} 
else {
blinkfor(100,230);
      }
   }
}
if(document.all) {
call_It();
}
//  End -->

[Zpixel]

i tried to keep safe what i had desigend.

1)tunnel php which Weedpacket found its secret, is somthing to check if user have disabled java or not, because a script must submit a form which lets the next page to be loaded. how did you found it? please write for me here to learn.

2)checking for browser type is to restrict user for disabling my MSIE compatible scripts. i know, this is a bug, but that page is not a real applicable site, it is a sample work to show my little experience on designing html,ajax,java and logo. so i decided not to allow others to save them easlily.

how did you get my script, leatherback? it is not special,but i bet on them.

could you finally save 'bookmaster.php' , could you disable java right click preventer script, could you get my ajax script or is it possible?

i bet on all.

[NogDog]

In Firefox it is very easy to defeat right-click disabling via JavaScript (along with a number of other annoying effects):

Options -> Content -> Enable Javascript -> Advanced

And even if you disable the right-click menus, any user can still view the source code via the browser menu bar options.

[Zpixel]

oh, i hadn't install my right click preventer script on my frames. this is the reason which leatherback used to save my script.

but could sombody save whole pages competely?
did you use any special tool to see trafic?

[Zpixel]

i restricted user just to use MSIE, Firefox is not allowded. is there any way still to see source?

[NogDog]

Sure. Just use the IE menu bar option View -> Source. (In IE7 you might have to first right-click on the menu bar area of the browser to turn on the menu bar.)

PS: Ultimately, everything that gets sent to the browser is viewable by anyone who cares to view it; it's the nature of the beast. You can make it difficult for the computer illiterate to find it, but anyone who knows what they're doing can get it if they're actually interested.

[Zpixel]

view-> source have been disabled by scripting. even from menu bar options. this is interesting to me.
disabling scripts have been disabled in tunnel.php.
using another browse type except MSIE is restricted by php scripting.

is there bugs or any weakener to my scripting?

[bradgrafelman]

Zpixel wrote:

using another browse type except MSIE is restricted by php scripting.

No; your PHP scripts only restrict the page to browsers that claim to be MSIE; FireFox (and many others, I'm sure, such as Opera) can easily do just that. Not to mention that restricting traffic only to IE is ridiculous (almost as ridiculous as IE :p).

Zpixel wrote:

is there bugs or any weakener to my scripting?

I don't quite know what to say... no such scripting can ever achieve that goal. Any web page must be sent to the browser in some format that is ultimately used to render HTML source code into a webpage. Unless you designed your page entirely using Flash and whatnot, HTML code can be revealed to those who wish to see it.

[leatherback]

I actually just pulled it from my cache 😃

[Zpixel]

thank you.
it's your right. i may try flash.

[leatherback]

You might need to rethink what you are doing. WHY are you oh so worried abut people seeing your JS?

[bradgrafelman]

Also note that I certainly wasn't recommending Flash or any third-party software like that... I personally hate the all-Flash sites (e.g. mycokerewards.com). :p

[Weedpacket]

leatherback wrote:

WHY are you oh so worried abut people seeing your JS?

Quite; from what's been seen so far it looks like you need to learn JavaScript a bit more, rather than fret about not letting anyone else see it.

Security measures are pointless if you're not clear on exactly what it is you're trying to secure.