Extracting Strings from script tag using javascript

Question

How can i extract all the strings present in script tags. I want to extract each string and find whether any shellcode is present. But javascript uses several methods in declaring a string For example a string can be

 var y="Some text";
 var x1 = "3+4";
 eval("\144\157\143\165\155\145\156\164"); //string given in eval();

It can be in a concatenated format

var x1 = "te ActiveX Co"; var x2 = "ntrol"; var x3 = x1 + x2; 
var x4 = "Execu" + x3;

How can i identify each and every string even if it is defined in eval() or document.write() by using simple javacript code.

Here's a hint - that's what the JavaScript interpreter does... — maerics
– maerics, Commented May 10, 2012 at 4:50
I don't see how it is possible to search for specific content inside concatenated strings like in your example, because (as in your example) the variables could be declared in any order, perhaps concatenated in a loop, or as elements of an array joined with .join(), etc. Variables could even be set with values retrieved via Ajax. You've asked for "simple" code, but I just don't think it is possible at all, let alone with simple code. — nnnnnn
– nnnnnn, Commented May 10, 2012 at 5:06
@shareef i want strings in script tag not script tag from a string. — user1335906
– user1335906, Commented May 10, 2012 at 5:42

maerics · Accepted Answer · 2012-05-10 05:54:15Z

1

This is a very complex problem for which there is no simple solution.

You could use a parser generator and the BNF definition of the ECMAScript language (surely you can find it on the web somewhere) to extract strings from the target source code.

[Edit] Since the linked parser generator is written in JavaScript and supports web browsers as a platform you can generate a custom ECMAScript parser, embed it in a page, and fetch all the embedded script source (e.g. $('script').map(function(){return $(this).text();})). Note that your custom parser could simply echo the parsed strings, e.g. via console.log(...).

edited May 10, 2012 at 5:54

answered May 10, 2012 at 4:54

maerics

157k47 gold badges277 silver badges299 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user1335906 Over a year ago

How can i add this Parser to my javascript

user1335906 Over a year ago

I am going through the Js/CC Parser User Manual. But the thing this they are asking to install the parser. But is there a way so that i can include the .js file in the script like <script src='jscc.js'></script> and perform the above function and obtain the result.

maerics Over a year ago

@user1335906: I haven't downloaded the JS/CC distribution but I wouldn't be surprised if the parser generator itself must be installed and only the generated parsers can be included as a script in a web page. You'll have to figure that out.

Collectives™ on Stack Overflow

Extracting Strings from script tag using javascript

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related