Detection and Analysis of Obfuscated and Minified JavaScript in the Croatian Web Space

JavaScript libraries allow for faster and easier programming of web content. In order to conceal know-how secrets and malicious code, obfuscation is used. Obfuscation is a deliberate act of reshaping something to make it harder to understand. Commonly used obfuscators provide many methods that produce different obfuscated versions of the same source code. Minification has similar techniques to obfuscation, but unlike obfuscation, minification reduces the size of the code, which speeds it up and is its primary functionality. This paper provides an overview of obfuscation and minification and the methods therein. The developed software tool uses regex, entropy and word size to detect and distinguish minified and obfuscated JavaScript libraries. The result of running the software tool on a database of pages in the Croatian web space is presented. The results show a high presence of minified and a small number of obfuscated JavaScript libraries. This automated detection has proven to be faster and in some cases more accurate than manual detection of obfuscation and minification. Observed problems with the tool implementation are commented on and potential improvements are discussed at the end of the paper.