KissAsian kissenc v=5

[twoure]

KissAsian kissenc v=5

[sudovijay]

it ain't big thing ! they just sending krsk as a post field which actually in the window.krsk ! just check the source code its there

var _0x83d6 = ["\x6B\x72\x73\x6B", "\x3C\x6B\x72\x73\x6B\x3E\x74\x65\x46\x77\x52\x4C\x4A\x6A\x77\x67\x3C\x2F\x6B\x72\x73\x6B\x3E"]'

i.e
var _0x83d6 = ["krsk", "teFwRLJjwg"]

[Twoure]

Thanks, will work on this soon.

[Twoure]

Fixed, refer to commit: 514094d

Have yet to merge into master branch, still working on some other bugs.

[sudovijay]

you might want to change the content-length value in the headers ! i quess they checking for that !
change it to 'Content-Length': '38' !

[Twoure]

Thanks for the heads up. Just noticed they changed the post value. Will work out a better fix.

[sudovijay]

yep they changed it too "gcGdcrFk" and just count the post field length which will give the content length. they checking for that too . need some better fix for that post though !

[Twoure]

Round two!

Fixed in 16f0946

Decided to start using PyExecJS to evaluate the js obfuscation. Might make life worse later, but we'll see.

[Twoure]

Fixed for now, so closing.