Last active
December 1, 2025 22:59
-
-
Save UnbuiltAlmond8/a0b8b5bb41c73f40d3e90e1143080892 to your computer and use it in GitHub Desktop.
A script to fetch and decrypt Worldometers.info's internal formulas.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| async function getWorldometersFormulas() { | |
| var resp = await fetch("https://www.realtimestatistics.net/rts/init.php?callback=jsoncallback&host=worldometers&time=" + Date.now(), { | |
| "headers": { | |
| "Referer": "https://www.worldometers.info", | |
| "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" | |
| } | |
| }); | |
| var callback = await resp.text(); | |
| var encrypted = callback.slice("jsoncallback( '".length, callback.length - "');".length); | |
| var decrypted = decryptRC4(encrypted, "worldometers.info"); | |
| return JSON.stringify(JSON.parse(decrypted), null, 4); | |
| } | |
| function decryptRC4(hexCiphertext, key) { | |
| /** | |
| * Decodes a Hex string into a binary string. | |
| * Corresponds to function u5() in the original code. | |
| */ | |
| function hexToBinaryString(hex) { | |
| // Validate hex input | |
| if (!hex.match(/^[a-f0-9]*$/i)) return false; | |
| // Pad with leading zero if length is odd | |
| if (hex.length % 2 !== 0) { | |
| hex = '0' + hex; | |
| } | |
| var result = []; | |
| for (var i = 0; i < hex.length; i += 2) { | |
| // Parse 2 characters at a time as Base16 (Hex) | |
| var charCode = parseInt(hex.substr(i, 2), 16); | |
| result.push(String.fromCharCode(charCode)); | |
| } | |
| return result.join(''); | |
| } | |
| /** | |
| * Performs RC4 Decryption/Encryption. | |
| * Corresponds to function q5() in the original code. | |
| */ | |
| function rc4(key, str) { | |
| var s = [], j = 0, x, res = ''; | |
| // Initialize S-box (0 to 255) | |
| for (var i = 0; i < 256; i++) { | |
| s[i] = i; | |
| } | |
| // KSA (Key-Scheduling Algorithm) | |
| for (var i = 0; i < 256; i++) { | |
| j = (j + s[i] + key.charCodeAt(i % key.length)) % 256; | |
| // Swap s[i] and s[j] | |
| x = s[i]; | |
| s[i] = s[j]; | |
| s[j] = x; | |
| } | |
| // PRGA (Pseudo-Random Generation Algorithm) | |
| var i = 0; | |
| j = 0; | |
| for (var y = 0; y < str.length; y++) { | |
| i = (i + 1) % 256; | |
| j = (j + s[i]) % 256; | |
| // Swap s[i] and s[j] | |
| x = s[i]; | |
| s[i] = s[j]; | |
| s[j] = x; | |
| // XOR operation | |
| var keyByte = s[(s[i] + s[j]) % 256]; | |
| res += String.fromCharCode(str.charCodeAt(y) ^ keyByte); | |
| } | |
| return res; | |
| } | |
| // Main execution flow | |
| // 1. Decode the Hex input (J) | |
| var binaryString = hexToBinaryString(hexCiphertext); | |
| if (binaryString === false) return ""; // Handle invalid hex | |
| // 2. Decrypt using RC4 (Key is E) | |
| var decryptedString = rc4(key, binaryString); | |
| // 3. Handle UTF-8 encoding | |
| try { | |
| return decodeURIComponent(escape(decryptedString)); | |
| } catch (e) { | |
| // Fallback if UTF-8 decoding fails | |
| return decryptedString; | |
| } | |
| } | |
| console.log(await getWorldometersFormulas()) |
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Interesting that Worldometers used RC4 with a weak key that represents their domain name.