Ads

Saturday 13 April 2019

Remove Footer Credits Link Any Blogger Templates.

Posted By: Creator/Author - April 13, 2019
Whatsapp
0



How blogger redirection works

The redirect from a website to another website you have to use window.location method of javascript, this method used a lot in blogger template to redirect to another website if you delete or replace their footer www.example.com, in this topic we will talk about how redirection work and how to remove it specially this can hurt you blog seo and performance and speed.

Blogger settimeout setinterval

As we say the Javascript redirection work with window.location method, but there is another 2 function setTimeout and setIntervalthose 2 function usually used in sliders effects and transition because setTimeout is a function will do a task after a time end , and setInterval will do a task every interval of time, and those 2 function used a lot in blogger redirection. how? After a time or interval they redirect to another website and of course here setInterval and setTimeout is the same thing because after setInterval redirect your blog there is no more interval. Example this code will explain the 3 way to redirect try it.
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html>
<html b:css='false' b:version='2'>
<head>
<b:skin><![CDATA[
]]></b:skin>
<b:template-skin>
<![CDATA[
]]>
</b:template-skin>
</head>
<body>
<b:section id='section'/>

<div id="mycontent"></div>
/*Redirect when window load*/
<script>
window.onload = function() {
var e = document.getElementById("mycontent");
if (e == null) {
window.location.href = "http://www.gatous.com/"
}
e.setAttribute("href", "http://www.gatous.com/");
e.setAttribute("ref", "dofollow");
e.setAttribute("title", "Blogger Templates");
e.innerHTML = "gatous"
}
/*Redirect after interval of time*/
setInterval(function(){
var e = document.getElementById("mycontent");
if (e == null) {
window.location.href = "http://www.gatous.com/"
}
e.setAttribute("href", "http://www.gatous.com/");
e.setAttribute("ref", "dofollow");
e.setAttribute("title", "Blogger Templates");
e.innerHTML = "gatous"

},3000);

/*Redirect after interval of Time end*/
setTimeout(function(){
var e = document.getElementById("mycontent");
if (e == null) {
window.location.href = "http://www.gatous.com/"
}
e.setAttribute("href", "http://www.gatous.com/");
e.setAttribute("ref", "dofollow");
e.setAttribute("title", "Blogger Templates");
e.innerHTML = "gatous"
},3000);</script>

</body>
</html>

Obfuscator the javascript redirection code

In the above code if you delete <div id="mycontent"></div>you will redirect to my website, and of course you will not find those 3 way to redirect your blog in plain code, they will try to hide the script, and as we say the javasript is a client side there is no much solution to obfuscate the code, most obfuscated javascript code you find an all the blogger is this x66 x65 x67 x68 ... when you find a code like this usually the first step you will do is try to beautify the code using javascript beautifier . if beautifier doesn't give you a solution then next step is check whether there is an eval() function or not. eval() is a function that run a text a javascript code example var operator='+';x =eval('1'+operator+'1'); the result of x here will return 2 .
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html>
<html b:css='false' b:version='2'>
<head>
<b:skin><![CDATA[
]]></b:skin>
<b:template-skin>
<![CDATA[
]]>
</b:template-skin>
</head>
<body>
<b:section id='section'/>
<div id="mycontent"></div>

<script>
var _0x182e = ['\x68\x72\x65\x66','\x72\x65\x66','\x64\x6f\x66\x6f\x6c\x6c\x6f\x77','\x74\x69\x74\x6c\x65','\x69\x6e\x6e\x65\x72\x48\x54\x4d\x4c','\x67\x65\x74\x45\x6c\x65\x6d\x65\x6e\x74\x42\x79\x49\x64','\x6d\x79\x63\x6f\x6e\x74\x65\x6e\x74','\x6c\x6f\x63\x61\x74\x69\x6f\x6e','\x68\x74\x74\x70\x3a\x2f\x2f\x77\x77\x77\x2e\x67\x61\x74\x6f\x75\x73\x2e\x63\x6f\x6d\x2f','\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65'];(function (_0x52bd93, _0x195ba3) {var _0xbefb71 = function (_0x4dd6e5) {while (--_0x4dd6e5) {_0x52bd93['push'](_0x52bd93['shift']());}};_0xbefb71(++_0x195ba3);}(_0x182e, 0xff));var _0x1726 = function (_0x9fffe4, _0x359def) {_0x9fffe4 = _0x9fffe4 - 0x0;var _0xd272b4 = _0x182e[_0x9fffe4];return _0xd272b4;};window['\x6f\x6e\x6c\x6f\x61\x64'] = function () {var _0x4933d2 = document[_0x1726('0x0')](_0x1726('0x1'));if (_0x4933d2 == null) {window[_0x1726('0x2')]['\x68\x72\x65\x66'] = _0x1726('0x3');}_0x4933d2[_0x1726('0x4')](_0x1726('0x5'), _0x1726('0x3'));_0x4933d2[_0x1726('0x4')](_0x1726('0x6'), _0x1726('0x7'));_0x4933d2[_0x1726('0x4')](_0x1726('0x8'), '\x42\x6c\x6f\x67\x67\x65\x72\x20\x54\x65\x6d\x70\x6c\x61\x74\x65\x73');_0x4933d2[_0x1726('0x9')] = '\x67\x61\x74\x6f\x75\x73';};
</script>
</body>
</html>

Obfuscator javascript redirection code with eval()

This below example is and Obfuscated javascript code that contain eval function and after beautify this code you will not find a javascript plain code you will find an eval() function and of course to unpack eval() you have to use malzilla .
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html>
<html b:css='false' b:version='2'>
<head>
<b:skin><![CDATA[
]]></b:skin>
<b:template-skin>
<![CDATA[
]]>
</b:template-skin>
</head>
<body>
<b:section id='section'/>


<div id="mycontent"></div>

<script>
var _0x32cf = ['\x72\x65\x70\x6c\x61\x63\x65','\x5c\x77\x2b','\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x7c\x66\x75\x6e\x63\x74\x69\x6f\x6e\x7c\x72\x65\x74\x75\x72\x6e\x7c\x7c\x69\x66\x7c\x74\x6f\x53\x74\x72\x69\x6e\x67\x7c\x32\x33\x7c\x77\x68\x69\x6c\x65\x7c\x72\x65\x70\x6c\x61\x63\x65\x7c\x68\x72\x65\x66\x7c\x7c\x67\x61\x74\x6f\x75\x73\x7c\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x7c\x63\x6f\x6d\x7c\x33\x36\x7c\x52\x65\x67\x45\x78\x70\x7c\x6e\x65\x77\x7c\x53\x74\x72\x69\x6e\x67\x7c\x77\x69\x6e\x64\x6f\x77\x7c\x65\x76\x61\x6c\x7c\x77\x77\x77\x7c\x42\x6c\x6f\x67\x67\x65\x72\x7c\x68\x74\x74\x70\x7c\x72\x65\x66\x7c\x54\x65\x6d\x70\x6c\x61\x74\x65\x73\x7c\x64\x6f\x66\x6f\x6c\x6c\x6f\x77\x7c\x73\x70\x6c\x69\x74\x7c\x6c\x6f\x63\x61\x74\x69\x6f\x6e\x7c\x69\x6e\x6e\x65\x72\x48\x54\x4d\x4c\x7c\x74\x69\x74\x6c\x65\x7c\x6d\x79\x63\x6f\x6e\x74\x65\x6e\x74\x7c\x67\x65\x74\x45\x6c\x65\x6d\x65\x6e\x74\x42\x79\x49\x64\x7c\x76\x61\x72\x7c\x64\x6f\x63\x75\x6d\x65\x6e\x74\x7c\x6e\x75\x6c\x6c\x7c\x6f\x6e\x6c\x6f\x61\x64','\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65','\x74\x6f\x53\x74\x72\x69\x6e\x67'];(function (_0x2d158c, _0x5267c3) {var _0x228c42 = function (_0x247644) {while (--_0x247644) {_0x2d158c['push'](_0x2d158c['shift']());}};_0x228c42(++_0x5267c3);}(_0x32cf, 0x1b6));var _0x1bab = function (_0x5074d3, _0x566e0b) {_0x5074d3 = _0x5074d3 - 0x0;var _0xf3aca9 = _0x32cf[_0x5074d3];return _0xf3aca9;};eval(function (_0x587dc3, _0x247d10, _0x447251, _0x526fc3, _0x5a7ae0, _0x3b60e4) {_0x5a7ae0 = function (_0x447251) {return (_0x447251 < _0x247d10 ? '' : _0x5a7ae0(parseInt(_0x447251 / _0x247d10))) + ((_0x447251 = _0x447251 % _0x247d10) > 0x23 ? String[_0x1bab('0x0')](_0x447251 + 0x1d) : _0x447251[_0x1bab('0x1')](0x24));};if (!''[_0x1bab('0x2')](/^/, String)) {while (_0x447251--) {_0x3b60e4[_0x5a7ae0(_0x447251)] = _0x526fc3[_0x447251] || _0x5a7ae0(_0x447251);}_0x526fc3 = [function (_0x5a7ae0) {return _0x3b60e4[_0x5a7ae0];}];_0x5a7ae0 = function () {return _0x1bab('0x3');};_0x447251 = 0x1;};while (_0x447251--) {if (_0x526fc3[_0x447251]) {_0x587dc3 = _0x587dc3[_0x1bab('0x2')](new RegExp('\x5c\x62' + _0x5a7ae0(_0x447251) + '\x5c\x62', '\x67'), _0x526fc3[_0x447251]);}}return _0x587dc3;}('\x46\x28\x6e\x28\x70\x2c\x61\x2c\x63\x2c\x6b\x2c\x65\x2c\x64\x29\x7b\x65\x3d\x6e\x28\x63\x29\x7b\x6f\x20\x63\x2e\x72\x28\x41\x29\x7d\x3b\x71\x28\x21\x27\x27\x2e\x75\x28\x2f\x5e\x2f\x2c\x44\x29\x29\x7b\x74\x28\x63\x2d\x2d\x29\x7b\x64\x5b\x63\x2e\x72\x28\x61\x29\x5d\x3d\x6b\x5b\x63\x5d\x7c\x7c\x63\x2e\x72\x28\x61\x29\x7d\x6b\x3d\x5b\x6e\x28\x65\x29\x7b\x6f\x20\x64\x5b\x65\x5d\x7d\x5d\x3b\x65\x3d\x6e\x28\x29\x7b\x6f\x27\x5c\x5c\x77\x2b\x27\x7d\x3b\x63\x3d\x31\x7d\x3b\x74\x28\x63\x2d\x2d\x29\x7b\x71\x28\x6b\x5b\x63\x5d\x29\x7b\x70\x3d\x70\x2e\x75\x28\x43\x20\x42\x28\x27\x5c\x5c\x62\x27\x2b\x65\x28\x63\x29\x2b\x27\x5c\x5c\x62\x27\x2c\x27\x67\x27\x29\x2c\x6b\x5b\x63\x5d\x29\x7d\x7d\x6f\x20\x70\x7d\x28\x27\x35\x2e\x63\x3d\x64\x28\x29\x7b\x62\x20\x65\x3d\x61\x2e\x37\x28\x22\x38\x22\x29\x3b\x39\x28\x65\x3d\x3d\x66\x29\x7b\x35\x2e\x6d\x2e\x34\x3d\x22\x36\x3a\x2f\x2f\x33\x2e\x30\x2e\x32\x2f\x22\x7d\x65\x2e\x31\x28\x22\x34\x22\x2c\x22\x36\x3a\x2f\x2f\x33\x2e\x30\x2e\x32\x2f\x22\x29\x3b\x65\x2e\x31\x28\x22\x69\x22\x2c\x22\x6c\x22\x29\x3b\x65\x2e\x31\x28\x22\x68\x22\x2c\x22\x6a\x20\x6b\x22\x29\x3b\x65\x2e\x67\x3d\x22\x30\x22\x7d\x27\x2c\x73\x2c\x73\x2c\x27\x78\x7c\x79\x7c\x7a\x7c\x47\x7c\x76\x7c\x45\x7c\x49\x7c\x52\x7c\x51\x7c\x71\x7c\x54\x7c\x53\x7c\x56\x7c\x6e\x7c\x7c\x55\x7c\x4f\x7c\x50\x7c\x4a\x7c\x48\x7c\x4b\x7c\x4c\x7c\x4e\x27\x2e\x4d\x28\x27\x7c\x27\x29\x2c\x30\x2c\x7b\x7d\x29\x29', 0x3a, 0x3a, _0x1bab('0x4')['\x73\x70\x6c\x69\x74']('\x7c'), 0x0, {}));
</script>

</body>
</html>

Be careful something injected after eval

Usually they don't use 1 eval() they use 2 or 3 eval() inside each other, and sometimes they inject something with the first or the second eval(); in this example i added document.write('another code');
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html>
<html b:css='false' b:version='2'>
<head>
<b:skin><![CDATA[
]]></b:skin>
<b:template-skin>
<![CDATA[
]]>
</b:template-skin>
</head>
<body>
<b:section id='section'/>


<div id="mycontent"></div>

<script>
eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('5.c=d(){b e=a.7("8");9(e==f){5.m.4="6://3.0.2/"}e.1("4","6://3.0.2/");e.1("i","l");e.1("h","j k");e.g="0"}',23,23,'gatous|setAttribute|com|www|href|window|http|getElementById|mycontent|if|document|var|onload|function||null|innerHTML|title|ref|Blogger|Templates|dofollow|location'.split('|'),0,{}));
document.write('another code');
</script>

</body>
</html>

Evaluate after inject

After inject document.write('another code'); i evaluate the code again and i get another obfuscate code.
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html>
<html b:css='false' b:version='2'>
<head>
<b:skin><![CDATA[
]]></b:skin>
<b:template-skin>
<![CDATA[
]]>
</b:template-skin>
</head>
<body>
<b:section id='section'/>


<div id="mycontent"></div>

<script>
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('N(n(p,a,c,k,e,d){e=n(c){o c.r(G)};q(!\'\'.u(/^/,B)){t(c--){d[c.r(a)]=k[c]||c.r(a)}k=[n(e){o d[e]}];e=n(){o\'\\\\w+\'};c=1};t(c--){q(k[c]){p=p.u(C D(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c])}}o p}(\'5.c=d(){b e=a.7("8");9(e==f){5.m.4="6://3.0.2/"}e.1("4","6://3.0.2/");e.1("i","l");e.1("h","j k");e.g="0"}\',s,s,\'H|A|y|z|x|I|F|K|W|q|v|T|S|n||V|X|Y|U|Q|L|R|J\'.M(\'|\'),0,{}));v.P(\'O E\');',61,61,'|||||||||||||||||||||||function|return||if|toString|23|while|replace|document||href|com|www|setAttribute|String|new|RegExp|code|http|36|gatous|window|location|getElementById|Templates|split|eval|another|write|Blogger|dofollow|onload|var|ref|null|mycontent|innerHTML|title'.split('|'),0,{}))
</script>

</body>
</html>

How unpack eval using malzilla

To unpack eval function using malzilla: copy the eval() function inside Decode tab and click Run script if there is another eval() copy the result again and paste it inside the decode and click Run script again until you got a plain javascript code.

Unpack eval using malzilla problems

After unpack the eval() using malzilla the document.write('another code'); changed to another code because the malzilla will execute the code and get result, so the point here if your obfuscated code have 3 eval() every time you unpack an eval() you have to check if there is another code if yes copy the other code another place and unpack the eval() get the result of the eval() and add the copied code.
window.onload=function(){var e=document.getElementById("mycontent");if(e==null){window.location.href="http://www.gatous.com/"}e.setAttribute("href","http://www.gatous.com/");e.setAttribute("ref","dofollow");e.setAttribute("title","Blogger Templates");e.innerHTML="gatous"}
another code
Home

About Creator/Author

Hax One Developers brings together the world's largest community of developers to discover, share, and build better software Webmasters From open source.

0 comment:

Post a Comment

Subscribe to: Post Comments (Atom)

Ads

Copyright © 2019 All Rights Reserved

Powered by RK FREE ZONE INDIA