Collected research
Ping pong obfuscation
Internet Explorer honours a language attribute and labelled statements inside event handlers, so an event can be switched to VBScript, and execScript bounces execution between VBScript and JavaScript repeatedly. Combining that with JScript.Encode and VBScript.Encode labels inside an event attribute hides the payload from filters while it still runs.
Record
- Researcher
- Gareth Heyes
- Published by
- thespanner.co.uk
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .