# Javascript Deobfuscation | Hack The Box Academy **Interactive Sessions & Skill Assessment** --- **Repeat what you learned in this section, and you should find a secret flag, what is it?** - Open a web browser > Navigate to target URL > Right click -> Inspect page or view source code. ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/34a2ed4b-50ce-4da2-aa76-a9553dd8e6c9.png align="center") - Answer: HTB{4lw4y5_r34d_7h3_50urc3} **Using what you learned in this section, try to deobfuscate 'secret.js' in order to get the content of the flag. What is the flag?** - After inspecting the source code, we do indeed find `secret.js` file. Click on it to read its content. ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/7d7d06b1-63cc-4e51-a905-39bc7826dac3.png align="center") - Let's copy and paste the code to ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/66106523-ac95-4f65-a4fd-31d4a67a6a88.png align="center") - Answer: HTB{1_4m_7h3_53r14l_g3n3r470r!} **Try applying what you learned in this section by sending a 'POST' request to '/serial.php'. What is the response you get?** ```shell curl -s http://154.57.164.70:30351/serial.php -X POST ``` ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/c38b4e00-9166-44a5-964c-f9169b2b4ba3.png align="center") - Answer: N2gxNV8xNV9hX3MzY3IzN19tMzU1NGcz **Using what you learned in this section, determine the type of encoding used in the string you got at previous exercise, and decode it. To get the flag, you can send a 'POST' request to 'serial.php', and set the data as "serial=YOUR_DECODED_OUTPUT".** - Let's copy `N2gxNV8xNV9hX3MzY3IzN19tMzU1NGcz` and paste it to to identify its encoding method. ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/8b4a2a91-68a7-4ef2-8a68-c87c1385b5fa.png align="center") - Now we know it's encoded with Base64, let's try to decode it. ```shell echo N2gxNV8xNV9hX3MzY3IzN19tMzU1NGcz | base64 -d ``` ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/3c276c97-0842-4484-b84f-778b4c5bef86.png align="center") - Let's send the data `"serial=7h15_15_a_s3cr37_m3554g3"` as a POST request to `/serial.php` ```shell curl -s http://154.57.164.70:30351/serial.php -X POST -d "serial=7h15_15_a_s3cr37_m3554g3" ``` ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/fe3a64e7-ce7c-407a-b92a-207647e5d449.png align="center") - Answer: HTB{ju57_4n07h3r_r4nd0m_53r14l} --- **Skill Assessment** **Question 1: Try to study the HTML code of the webpage, and identify used JavaScript code within it. What is the name of the JavaScript file being used?** - Navigate to web browser > Right click > Inspect Element/ View Page Source ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/8bde9146-8c5d-4469-ae19-304de6a8c8c9.png align="center") - Answer: api.min.js **Question 2: Once you find the JavaScript code, try to run it to see if it does any interesting functions. Did you get something in return?** - Let's click on the file to read it's content: ```shell eval(function(p, a, c, k, e, d) { e = function(c) { return c.toString(36) }; if (!''.replace(/^/, String)) { while (c--) { d[c.toString(a)] = k[c] || c.toString(a) } k = [function(e) { return d[e] }]; e = function() { return '\\w+' }; c = 1 } ; while (c--) { if (k[c]) { p = p.replace(new RegExp('\\b' + e(c) + '\\b', 'g'), k[c]) } } return p }('t 5(){6 7=\'1{n\'+\'8\'+\'9\'+\'a\'+\'b\'+\'c!\'+\'}\',0=d e(),2=\'/4\'+\'.g\';0[\'f\'](\'i\',2,!![]),0[\'k\'](l)}m[\'o\'](\'1{j\'+\'p\'+\'q\'+\'r\'+\'s\'+\'h\'+\'3}\');', 30, 30, 'xhr|HTB|_0x437f8b|k3y|keys|apiKeys|var|flag|3v3r_|run_0|bfu5c|473d_|c0d3|new|XMLHttpRequest|open|php|n_15_|POST||send|null|console||log|4v45c|r1p7_|3num3|r4710|function'.split('|'), 0, {})) ``` - Let's copy it and run it in ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/abea562a-4c08-4285-bdec-a8c650413485.png align="center") - Answer: HTB{j4v45cr1p7_3num3r4710n_15_k3y} **Question 3: As you may have noticed, the JavaScript code is obfuscated. Try applying the skills you learned in this module to deobfuscate the code, and retrieve the 'flag' variable.** - It seems the code inside `api.min.js` file is obfuscated. Let's deobfuscate it using ```shell #Deobfuscated result: function apiKeys() { var flag='HTB { n'+'3v3r_'+'run_0'+'bfu5c'+'473d_'+'c0d3!'+' } ',xhr=new XMLHttpRequest(),_0x437f8b='/keys'+'.php'; xhr['open']('POST',_0x437f8b,!![]),xhr['send'](null) } console['log']('HTB { j'+'4v45c'+'r1p7_'+'3num3'+'r4710'+'n_15_'+'k3y } '); ``` - Answer: HTB{n3v3r_run_0bfu5c473d_c0d3!} **Question 4: Try to Analyze the deobfuscated JavaScript code, and understand its main functionality. Once you do, try to replicate what it's doing to get a secret key. What is the key?** - It seems the javascript code is sending a POST request to `/keys.php` ```shell curl -s http://154.57.164.65:32543/keys.php -X POST ``` ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/a34db01e-d255-4f82-92ca-867c3bc2996b.png align="center") - Answer: 4150495f70336e5f37333537316e365f31355f66756e **Question 5: Once you have the secret key, try to decide it's encoding method, and decode it. Then send a 'POST' request to the same previous page with the decoded key as "key=DECODED_KEY". What is the flag you got?** - It seems the secret key is encoded with hex. - *Note: You can spot hex encoding by checking that a string uses only the characters* `0-9` *and* `a-f`*/*`A-F`*, has an even total length (since each byte is represented by exactly 2 hex characters), and lacks symbols like* `=`*,* `+`*, or* `/` *that would instead point to something like Base64 — the string* `4150495f70336e5f...` *fits this pattern exactly, being 46 characters of strictly* `0-9`*/*`a-f`*, which is the classic tell for hex.* ```shell echo 4150495f70336e5f37333537316e365f31355f66756e | xxd -p -r ``` ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/dae9b9c2-2558-48b8-8c97-64631bad10e7.png align="center") - Now, lets send a POST request with the decoded key as `"key=API_p3n_73571n6_15_fun"` ```shell curl -s http://154.57.164.65:32543/keys.php -X POST -d "key=API_p3n_73571n6_15_fun" ``` ![](https://cdn.hashnode.com/uploads/covers/6a348dcda801132929e39301/f6ad58fa-0a1d-462c-bb10-c9c80d4559b2.png align="center") - Answer: HTB{r34dy_70_h4ck_my_w4y_1n_2_HTB}