how to deobfuscate malicious javascript - part2

Hacker Halted 2010

731
vote

in first part we discussed about how to use rhino to obfuscate the JavaScript.but i found another way of doing it.
you can also use mina which will hook the IE and then display the results.although i am not able to get it to work on IE6. it worked just fine on IE8 on my side.
Also another way will be to use paros proxy,trap the request and change the eval call to document.write this will also work :)

Trackback URL for this post:

http://secgeeks.com/trackback/2616