In the preceding recipe, we faced a filtering mechanism that removed the opening script tag. As <script> is not the only tag that may be used in an XSS attack and JavaScript code is more consistent than HTML in terms of capitalization and structure, some filters try to restrict the use of words and characters belonging to JavaScript code, such as alert, cookie, and document.
In this recipe, we will explore an alternative, a somewhat extreme one maybe, of code obfuscation using a so-called esoteric language called JSFuck (http://JSFuck.com).
