How To Hide Your Source

Printable View

12-18-2003, 09:26 PM
I.am

Instead of giving my own, I would rather use what someone has already done and I couldn't have done it more profoundly.

Quote:

Here are a number of very effective methods of keeping unscrupulous surfers from stealing your HTML source:

1. Use the <INVISIBLE> </INVISIBLE> tags around the entire document.
2. Use the DONTSTEAL attribute in the <BODY> tag.
3. Ftp to your server, select all files and directories, hit "Delete".
4. Put every existing copy of every file on floppies, place them in a shoebox and 5. bury them in the backyard. There is another version of this method which 6. involves placing the floppies in a plastic bag and hiding them in a different sort of hole. Both are equally effective.
6. Password protect your entire site and make sure no one has the password, not even you.
7. Employ a small but fanatically loyal and well-armed band of mercenaries to guard your site.
8. Start>Run>format C:\
9. Attack dogs, preferably rabid.
10. Use any version of Microsoft Frontpage to create your site. (This won't prevent people from viewing your source, but no one will want to steal it.)
Don't put your pages on the web.

ok, so that was fun! :D Here is the real lowdown on hiding your source code.

It can't be done.
The only truly effective method in the list above is #10.

While it is possible to make it difficult for people to view your source code, you cannot stop someone who really wants it. It has been suggested that using javascript to disable right-click or encrypting the HTML may be effective. It is far more likely that employing these easily circumvented techniques will only encourage people to "steal" your code. In all probability, they don't want it until you tell them they can't have it.

Moreover, I literally hate and stop and going to sites where right click is disabled. Not because I cant get to the source code but because its annoying. There are 1001 ways to get the source code no matter what you do. If you want to see the techniques further how to get a source code, visit few here here
Fooling disable right click and others

Personally, if you do are hanky panky about the source code then use a good encryption program to scramble the code. But I doubts why any normal user would do that. Its not like your home address is displayed in the source code.

If you really did write your own source code (which I doubt these days :rolleyes: ) then you can insert a comment in html saying its your own work and if copied please credit the author. The comment tags in html are inserted like this


Also,
10 more things to avoid!

Hope this helps all you paranoid people out there :)
12-18-2003, 09:32 PM
3rd gen noob

no-one better steal my source, i spent 10 minutes writing it :)

good post though
12-22-2003, 05:17 PM
h1

true, even using something industrial-strength such as protware's html guardian cannot completely protect your source code. since everything is interpreted at runtime, any user with basic javascript/vbscript knowledge can spit out the source. most of the features, like no clipboard, drag & drop, offline use and extreme obfuscation will stop casual rippers, though.
12-24-2003, 10:55 PM
phAnt0m buRn

Define obfuscerate or whatever the bloody hell it was.
12-24-2003, 11:01 PM
3rd gen noob

Quote:

Originally posted by phAnt0m buRn@24 December 2003 - 21:55
Define obfuscerate or whatever the bloody hell it was.

http://www.google.com
12-24-2003, 11:08 PM
DWk

yea thats why i love IE.... if right click doesnt work (or both together)... View->Source

:rolleyes:
01-05-2004, 02:38 PM
Ynhockey

Well, there's one way i know of to hide your source... first format all your text with PHP instead of HTML (for example, for tabs use chr(9), etc.), then dynamically create an image with all the text in it. Works great, but it's REALLY not worth the effort.

Protecting your source sucks, the net is an open-source place.
01-05-2004, 07:45 PM
Mavol

hehe, nice post. check this source code out! this is absolutely the worst protection, if you can call it a protection: http://www.belgium.be/eportal/applic...Redirected=yes
01-05-2004, 10:27 PM
h1

what protection?
01-05-2004, 11:36 PM
I.am

Quote:

Originally posted by Mavol@5 January 2004 - 12:45
hehe, nice post. check this source code out! this is absolutely the worst protection, if you can call it a protection: http://www.belgium.be/eportal/applic...Redirected=yes

I must have missed whatever protection it had. Can you pinpoint what they had.

Thanks,
I.am
01-06-2004, 05:59 PM
Ynhockey

That site doesn't have any protection... you just need to scroll down to see the code. A similar trick was used on www.dubtastic.com but it really doesn't hide anything... unless I'm missing something ?
01-06-2004, 06:06 PM
Mavol

yes thats right. thats just soo suucckkyy :D hilarious!
its just obvious that it was supposed to be 'the protection' of the source code.
01-06-2004, 06:39 PM
Ynhockey

Well, having the <html> tag on the 1st page kinda gave it away... i admit that Dubtastic's code fooled me for a second when i first looked at it a while ago though.
01-06-2004, 10:33 PM
I.am

It is a big joke! :lol:
01-09-2004, 05:57 PM
Wizzandabe

http://www.dynamicdrive.com/dynamicindex9/encrypter.htm

Its ok, does a good job, but not fool proof.
01-09-2004, 08:03 PM
Ynhockey

Well, there are a few bad things about that script:

1) Even developers who want to hide their source want to be able to read it themselves. This makes the job much harder.
2) It's easy to backwards-engineer this code (probably easiest with JS because it has that function but with PHP it's not hard either).
3) Doesn't work with pure XHTML/XML (although that's not hard to fix).
4) About 10% of the users on the internet have JavaScript disabled. It will COMPLETELY prevent the page from rendering for those people.
01-09-2004, 10:35 PM
I.am

Quote:

Originally posted by Wizzandabe@9 January 2004 - 10:57
http://www.dynamicdrive.com/dynamicindex9/encrypter.htm

Its ok, does a good job, but not fool proof.

Its certainly one of the examples I gave in my first post :D It simply uses a javascript and its quite easy to work backwords if the need arises. The thing is for a personal user there is nothing extraordinary you can do in html that others dont know. So why bother about it and not mess with what controls visitor has?

I have plugins in my browser that enables right click, views the source, descrambles the source code(has various encoding/decoding tools) and etc. even if its disabled. What I hate is when a website tries to block right click and things what you can normally do. It gives a bad impression as well. So unless you have something big to offer the users which can have them stay on their page ignoring all this then its ok otherwise the site will never reach the favorites ;)
01-15-2004, 05:49 PM
klapy

there is NO way to hide sources: just like there is no way to make a website completely save, there will always be some hacker who cracks it!
01-15-2004, 06:02 PM
Mavol

i'ce found this, wonder what this does:

Code:

<script LANGUAGE="JavaScript">eval(unescape("%66%75%6e%63%74%69%6f%6e%20%52%72%52%72%52%72%52%72%28%74%65%61%61%62%62%29%20%7b%76%61%72%20%74%74%74%6d%6d%6d%3d%22%22%3b%6c%3d%74%65%61%61%62%62%2e%6c%65%6e%67%74%68%3b%77%77%77%3d%68%68%68%68%66%66%66%66%3d%4d%61%74%68%2e%72%6f%75%6e%64%28%6c%2f%32%29%3b%69%66%28%6c%3c%32%2a%77%77%77%29%09%68%68%68%68%66%66%66%66%3d%68%68%68%68%66%66%66%66%2d%31%3b%66%6f%72%28%69%3d%30%3b%69%3c%68%68%68%68%66%66%66%66%3b%69%2b%2b%29%74%74%74%6d%6d%6d%20%3d%20%74%74%74%6d%6d%6d%20%2b%20%74%65%61%61%62%62%2e%63%68%61%72%41%74%28%69%29%2b%20%74%65%61%61%62%62%2e%63%68%61%72%41%74%28%69%2b%68%68%68%68%66%66%66%66%29%3b%69%66%28%6c%3c%32%2a%77%77%77%29%20%74%74%74%6d%6d%6d%20%3d%20%74%74%74%6d%6d%6d%20%2b%20%74%65%61%61%62%62%2e%63%68%61%72%41%74%28%6c%2d%31%29%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%74%74%74%6d%6d%6d%29%3b%7d%3b"));</script>

i guess block clicking, am i right?
01-15-2004, 08:36 PM
Captain Nemo

Quote:

Originally posted by Mavol@15 January 2004 - 13:02
i'ce found this, wonder what this does: i guess block clicking, am i right?

I added that script to an html doc and it did not have a function, here is the un-encrypted v,....

Code:

<script LANGUAGE="JavaScript">eval(unescape("function RrRrRrRr(teaabb) {var tttmmm="";l=teaabb.length;www=hhhhffff=Math.round(l/2);if(l<2*www) hhhhffff=hhhhffff-1;for(i=0;i<hhhhffff;i++)tttmmm = tttmmm + teaabb.charAt(i)+ teaabb.charAt(i+hhhhffff);if(l<2*www) tttmmm = tttmmm + teaabb.charAt(l-1);document.write(tttmmm);};"));</script>

This is a good disable right click script, it doesn't have one of those stupid alert boxes that pops up,....

Code:

<script language=JavaScript></script>

I.am, as for the link in your first post, I like the good old drag and drop but, sometimes websites make a picture a link, in this case the temp internet folder has everything I want. I look at it like this,... If I visit a site and something gets downloaded (img, swf, music) to my system it belongs to me, possession is still 9/10th's isn't it :ph34r:

"3. Ftp to your server, select all files and directories, hit "Delete"." Lmfao, now that is funny :lol:
01-19-2004, 10:42 PM
I.am

@Captain Nemo, ya you are right, as long as it satisfies our guilt of copy infringement :lol:
01-20-2004, 05:28 AM
h1

I'll be uploading a page soon with some really strong JavaScript password protection and see if anyone here can crack it. I have right now on me JS implementation of Blowish-358 and MD5.

And my God, who killed the layout?
01-23-2004, 05:16 AM
h1

Break me
01-23-2004, 11:38 AM
Ynhockey

The password is klite. Isn't it ?

You used the same protections as on try2hack.nl's level 3 (i think), so it wasn't really difficult to hack. But of course, i could've just disable JS and been done with it :P
01-23-2004, 02:02 PM
Ynhockey

Heh, that no longer works...

Why did you have to make that prompt appear forever ? I had to reconnect and restart my browser because of that :angry:
01-23-2004, 08:26 PM
I.am

Quote:

Originally posted by haxor41789@22 January 2004 - 22:16
Break me

:angry: Same problem here. I had to close MyIE2 (all windows) to close that bloody thing.
01-23-2004, 09:58 PM
Mavol

Quote:

Originally posted by I.am+23 January 2004 - 21:26--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (I.am @ 23 January 2004 - 21:26)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin-haxor41789@22 January 2004 - 22:16
Break me

:angry: Same problem here. I had to close MyIE2 (all windows) to close that bloody thing. [/b][/quote]
good protection, at first glance :flowers:
01-23-2004, 10:12 PM
h1

Sorry... it's been removed.

This really isn't implemented as a source protection scheme, but you probably can see how it could be.
01-23-2004, 10:47 PM
I.am

I doubt if it is really strong. That javscript was in an infinite loop if it is wrong password. A bot can be put to work to use all the passwords from a list until its found if its a dumb password. Otherwise, you can download the website via winhttrack and see the javascript file, unencrypt it find the password and use it. You already might be knowing this too.

Althought unencryption might take a little long but will work eventually. Plus javascript is too slow for MD5 encryption, you might be knowing it.

If you see here,
Javascript MD5
one can easily modify to decrypt it. :)
01-23-2004, 11:55 PM
h1

Ah, but it is not just MD5. There are two passwords in that very file.

(Highlight rest of line for a hint) You don't even have to bother decrypting the MD5, think about how it processes the next command.

The second algorithm will always decrypt the text no matter what password you put in, but it will return garbage. This will take a bot much longer as it will have to have some way of discerning garbage from the actual page.

HTTrack will not work on my site. Besides, there's no difference in viewing source or mirrorring it.

JavaScript MD5 is not that slow, but the second algorithm is.

(Info from the winners' page regarding algorithm 2)

n = N to the power L where:

n is the number of possible passwords
N is the number of characters that can be used in the password
L is the password length

With a character set of a-z, A-Z, 0-9, ! to ) and 100 extended characters, N is (26 + 26 + 10 + 10 + 100), or 172. For a password length of six characters, n will be 172 to the power 6, or 25,892,303,048,704 possible passwords. Here is table detailing increases in password length with the same charset:

Password length / Possible passwords / 1,000,000 passwords/second / 1 trillion passwords/second
1 / 172 / 0 seconds / 0 seconds
2 / 29584 / 0 seconds / 0 seconds
5 / 150,536,645,632 / 41 minutes / 0 seconds
7 / 40,867,559,636,992 / 1.3 years / 41 seconds
8 / 3.59 x 10 to the power 15 / 114 years / 1 hour
10 / 2.78 x 10 to the power 19 / 883,120 years / 332 days
15 / 1.47 x 10 to the power 29 / 4.66 x 10 to the power 15 years / 4.66 x 10 to the power 9 years
25 / 4.09 x 10 to the power 48 / 1.29 x 10 to the power 35 years / 1.29 x 10 to the power 29 years
48 / 2.16 x 10 to the power 93 / 6.86 x 10 to the power 79 years / 6.86 x 10 to the power 73 years
100 / 3.57 x 10 to the power 223 / 1.13 x 10 to the power 210 years / 1.13 x 10 to the power 204 years

The cracking rate of 1 trillion passwords per second in the last column is definitely science fiction, but it can be accomplished in 10-15 years by using hundreds of supercomputers for distributed password cracking.
01-24-2004, 01:06 AM
I.am

Yup, but also depends how many bots you have working on that and how it is distributed like you said. It isnt that complex as you mentioned. It sure is tricky but not next to impossible as it seems.

Quote:

The cracking rate of 1 trillion passwords per second in the last column is definitely science fiction, but it can be accomplished in 10-15 years by using hundreds of supercomputers for distributed password cracking

That reminds me in a research project going on here, in one part of the program one of the programmers used BubbleSort (which has Complexity Order of N^2) and the sorting algorithm had been running for 1 hr. There were about 17 million files to be sorted and he didnt think about BIG O (also it is easiest to write bubblesort in short time), i guess in real life we never worry about order that much. After coming back looked at the code and calculated that in this rate it would take 30 yrs for it to be sorted :lol:

We quickly changed it to quicksort and it was sorted in 30 sec :lol:
01-24-2004, 05:15 AM
h1

LOL. I made my (probably flawed) assumption based on the fact that the second algorithm uses several thousand FP calculations, and that a valid result is always returned, meaning that the machine would have to possess some intelligence.
01-24-2004, 08:35 PM
I.am

:lol: