Question

I am getting weird characters on a script of a web page. This is part of the script

___=~[];___={___:++___,$$$$:(![]+"")[___],__$:++___,$_$_:(![]+"")[___],_$_:++___,$_$$:({}+"")[___],$$_$:(___[___]+"")[___],_$$:++___,$$$_:(!""+"")[___],$__:++___,$_$:++___,$$__:({}+"")[___],$$_:++___,$$$:++___,$___:++___,$__$:++___};___.$_=(___.$_=___+"")[___.$_$]+(___._$=___.$_[___.__$])+(___.$$=(___.$+"")[___.__$])+((!___)+"")[___._$$]+(___.__=___.$_[___.$$_])+(___.$=(!""+"")[___.__$])+(___._=(!""+"")[___._$_])+___.$_[___.$_$]+___.__+___._$+___.$;___.$$=___.$+(!""+"")[___._$$]+___.__+___._+___.$+___.$$;___.$=(___.___)[___.$_][___.$_];___.$(___.$(___.$$+"\""+"\\"+___.__$+___.$$_+___.$$_+___.$_$_+"\\"+___.__$+___.$$_+___._$_+"\\"+___.$__+___.___+___._$+___.$_$$+"\\"+___.__$+___.$_$+___._$_+"\\"+___.$__+___.___+"=\\"+___.$__+___.___+"{\\"+___.$__+___.___+"};\\"+___.__$+___._$_+___._$+___.$_$$+"\\"+___.__$+___.$_$+___._$_+".\\"+___.__$+___.$$_+___._$$+___.$$$_+___.$$__+"\\"+___.__$+___.$$_+___._$_+___.$$$_+___.__+"\\"+___.$__+___.___+"=\\"+___.$__+___.___+"\\\"\\"+___.__$+___.___+___.__$+"\\"+___.__$+___.$_$+___.$$_+"\\"+___.__$+___.$__+___.$$$+___.$$$_+(![]+"")[___._$_]+"\\"+___.__$+___.$_$+___.__$+"\\"+___.__$+___.$_$+___.$$_+___.$_$_+"\\"+___.$__+___.___+"\\"+___.

This translates in a weird way to alert(“why”). How is that possible?

Answer 1

This is called code obfuscation, using utf-8 characters that are other than our english alphabet. The variables have valid names, and there are usually calls to functions that will do conversions to supply english text for output via alerts, etc.

See here for a good discussion: How can I obfuscate (protect) JavaScript?