iCTF 2011 challenge 15 writeup (150 points)20 Dec 2011
To further look into window.alert, we can overwrite the function:
After re-running the code we see that window.alert is not being called with a String as argument, but with an object which contains the attribute:
The solution is obviously: Hackers.
FYI: Before the obfuscation the code looked like this: