Obfuscated javascript code with binary values?

Question

This code outputs D. The question is HOW?

alert([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[         


        

Answer 1

It does some tricks with the javascript type conversions. As CMS pointed out, it's equivalent to: []['sort']['call']()["btoa"]("00")[1];

They build the strings by pulling them out of things like false, etc.

For example, to get the s in "sort":

Get a "false": (![]+[]) -- ![] returns false and +[] converts it to a string.

Get the value 3 with: !+[]+!+[]+!+[] - each !+[] returns true, but when you add booleans you get an integer representation. e.g. true + true = 2

Get the s with string index access notation ("false"[3] = 's'): (![]+[]) [!+[]+!+[]+!+[]]

And now you have an s. They keep doing that until they have enough to access whichever method or property they want.