UglifyJS

UglifyJS Description

The UglifyJS toolkit performs various actions on JavaScript code without changing its functionality.

The program can parse, compress, obfuscate, or, conversely, make JavaScript scripts more readable.

Note:

• uglify-js supports JavaScript and most language features in ECMAScript.
• For more exotic parts of ECMAScript, process your source file with transpilers like Babel before passing onto uglify-js.

Homepage: http://lisperator.net/uglifyjs/

GitHub: https://github.com/mishoo/UglifyJS

Author: Mihai Bazon

License: BSD

UglifyJS Help

Command line usage:

uglifyjs [input files] [options]

UglifyJS can take multiple input files. It's recommended that you pass the input files first, then pass the options. UglifyJS will parse input files in sequence and apply any compression options. The files are parsed in the same global scope, that is, a reference from a file to some variable/function declared in another file will be matched properly.

If no input file is specified, UglifyJS will read from STDIN.

If you wish to pass your options before the input files, separate the two with a double dash to prevent input files being used as option arguments:

uglifyjs --compress --mangle -- input.js

Command line options:

  -h, --help                               Print usage information.
                                           `--help options` for details on available options.
  -v, -V, --version                        Print version number.
  -p, --parse <options>                    Specify parser options.
  -c, --compress [options]                 Enable compressor/specify compressor options.
  -m, --mangle [options]                   Mangle names/specify mangler options.
  --mangle-props [options]                 Mangle properties/specify mangler options.
  -b, --beautify [options]                 Beautify output/specify output options.
  -O, --output-opts <options>              Output options (beautify disabled).
  -o, --output <file>                      Output file (default STDOUT).
  --annotations                            Process and preserve comment annotations.
  --no-annotations                         Ignore and discard comment annotations.
  --comments [filter]                      Preserve copyright comments in the output.
  --config-file <file>                     Read minify() options from JSON file.
  -d, --define <expr>[=value]              Global definitions.
  -e, --enclose [arg[,...][:value[,...]]]  Embed everything in a big function, with configurable argument(s) & value(s).
  --ie8                                    Support non-standard Internet Explorer 8.
  --keep-fnames                            Do not mangle/drop function names. Useful for code relying on Function.prototype.name.
  --name-cache <file>                      File to hold mangled name mappings.
  --rename                                 Force symbol expansion.
  --no-rename                              Disable symbol expansion.
  --self                                   Build UglifyJS as a library (implies --wrap UglifyJS)
  --source-map [options]                   Enable source map/specify source map options.
  --timings                                Display operations run time on STDERR.
  --toplevel                               Compress and/or mangle variables in toplevel scope.
  --validate                               Perform validation during AST manipulations.
  --verbose                                Print diagnostic messages.
  --warn                                   Print warning messages.
  --webkit                                 Support non-standard Safari/Webkit.
  --wrap <name>                            Embed everything as a function with “exports” corresponding to “name” globally.

(internal debug use only)
  --in-situ                                Warning: replaces original source files with minified output.
  --reduce-test                            Reduce a standalone test case (assumes cloned repository).

Specify --output (-o) to declare the output file. Otherwise the output goes to STDOUT.

UglifyJS Usage Example

Improve the appearance of the /var/www/html/dvwa/vulnerabilities/javascript/source/medium.js file, which will be passed from standard input:

cat /var/www/html/dvwa/vulnerabilities/javascript/source/medium.js | uglifyjs -b

Compress and/or distort variables in the top-level scope, do not concatenate sequential simple statements using the comma operator:

uglifyjs file.js -c toplevel,sequences=false

How to install UglifyJS

Installation on Kali Linux

sudo apt install uglifyjs

Installation on Debian, Linux Mint, Ubuntu

sudo apt update
sudo apt install uglifyjs

Installation on BlackArch

The program is pre-installed on BlackArch.

sudo pacman -S uglify-js

UglifyJS online service

It is not necessary to install the program on a computer, the author has created a page where you can try UglifyJS: http://lisperator.net/uglifyjs/ (find “Open demo” inscription).

Paste your code in the left box. Click “Uglify!” to get compressed output on the right. The left-side will turn into the Ymacs editor. At this point if you click any token in the minified area, the editor on the left will move to the original location of that minified token.

Tick the “As I type” checkbox to turn on minification on-the-fly.

When the compressor warns, you'll get a flashing button in the toolbar. Click on it to display the warnings (temporarily covers the minified area). Click a warning in the list to go to that position in the source. If you have "on-the-fly" and fix warnings, the list will update automatically.

You can enable/disable the compressor, mangler and beautifier. For additional control check the buttons on the right (“Compressor…” and “Codegen…”). Those options are saved in localStorage, they will be remembered the next time you visit this page.

UglifyJS Screenshots

UglifyJS Tutorials

• How to deobfuscate JavaScript code
• How to see JavaScript code written using unprintable characters
• JavaScript Attacks