Expand JavaScript Analysis
This commit is contained in:
p$3ud0R@nD0m
GitHub
parent
89a21e728e
commit
09d13e427f
@ -37,11 +37,93 @@ https://libraries.io/pypi/detect-secrets
|
|||||||
```
|
```
|
||||||
|
|
||||||
## JavaScript
|
## JavaScript
|
||||||
|
### Discovery
|
||||||
|
1. Burp:
|
||||||
|
- Spider and discover content
|
||||||
|
- Sitemap > filter
|
||||||
|
- Sitemap > right-click domain > Engagement tools > Find scripts
|
||||||
|
2. [WaybackURLs](https://github.com/tomnomnom/waybackurls):
|
||||||
|
- `waybackurls <domain> |grep -i "\.js" |sort -u`
|
||||||
|
### Static Analysis
|
||||||
|
#### Unminimize/Beautify/Prettify
|
||||||
|
https://prettier.io/playground/
|
||||||
|
https://beautifier.io/
|
||||||
|
#### Deobfuscate/Unpack
|
||||||
|
__Note__: It may not be possible to fully deobfuscate.
|
||||||
|
1. Find and use .map files:
|
||||||
|
- If the .map files are exposed, they can be used to easily deobfuscate.
|
||||||
|
- Commonly, foo.js.map maps to foo.js. Manually look for them.
|
||||||
|
- Use [JS Miner](https://github.com/PortSwigger/js-miner) to look for them.
|
||||||
|
- Ensure active scan is conducted.
|
||||||
|
- Read '[Tips/Notes](https://github.com/minamo7sen/burp-JS-Miner/wiki#tips--notes)'
|
||||||
|
- If found, use [Maximize](https://www.npmjs.com/package/maximize) to deobfuscate.
|
||||||
|
2. Without .map files, try JSnice:
|
||||||
|
- References: http://jsnice.org/ & https://www.npmjs.com/package/jsnice
|
||||||
|
- Tips:
|
||||||
|
- If using jsnice.org, click on the options button next to the "Nicify JavaScript" button, and de-select "Infer types" to reduce cluttering the code with comments.
|
||||||
|
- Ensure you do not leave any empty lines before the script, as it may affect the deobfuscation process and give inaccurate results.
|
||||||
|
3. Use console.log(<packerReturnVariable>);
|
||||||
|
- Find the return value at the end and change it to `console.log(<packerReturnVariable>);` so the deobfuscated js is printed instead of being executing.
|
||||||
|
- Then, paste the modified (and still obfuscated) js into https://jsconsole.com/ to see the deobfuscated js logged to the console.
|
||||||
|
- Finally, paste the deobfuscated output into https://prettier.io/playground/ to beautify it for analysis.
|
||||||
|
- __Note__: If you are still seeing packed (but different) js, it may be recursively packed. Repeat the process.
|
||||||
|
#### Analyze
|
||||||
|
References:
|
||||||
|
https://medium.com/techiepedia/javascript-code-review-guide-for-bug-bounty-hunters-c95a8aa7037a
|
||||||
|
|
||||||
```
|
Look for:
|
||||||
https://jshint.com/
|
- Anti-debug loading
|
||||||
https://github.com/jshint/jshint/
|
- Angular: [enableProdMode](https://blog.nvisium.com/angular-for-pentesters-part-2)
|
||||||
```
|
- Secrets
|
||||||
|
- Use:
|
||||||
|
- [JS Miner](https://github.com/PortSwigger/js-miner)
|
||||||
|
- [RegHex](https://github.com/l4yton/RegHex) patterns
|
||||||
|
- [gf](https://github.com/tomnomnom/gf/tree/master/examples) patterns
|
||||||
|
- Grep relevant dictionary patterns:
|
||||||
|
- pass, user, admin
|
||||||
|
- auth, login, sign, challenge, 2fa
|
||||||
|
- key, apikey, api_key, api-key, jwt, token
|
||||||
|
- secret, security, secure
|
||||||
|
- ...
|
||||||
|
- Manual review
|
||||||
|
- If API key found, check here for potential usage syntax: https://github.com/streaak/keyhacks.
|
||||||
|
- Vuln functions
|
||||||
|
- InnerHTML() - If you found this, it means there is a potential chance for XSS if no proper sanitisation takes place. Even if your payload is sanitised, don’t worry. Trace the code to find out where the sanitisation takes place. Study it and try to get around the sanitisation.
|
||||||
|
- Postmessage() - If you have read my previous post (https://medium.com/techiepedia/what-are-sop-cors-and-ways-to-exploit-it-62a5e02100dc), you would notice that Postmessage() might lead to potential CORS issue. If the second parameter of the function set to *, you are the lucky one. Checkout my previous post to understand more about the mechanism behind.
|
||||||
|
- String.prototype.search() - This function looks normal. Why would it be a dangerous function? Well, it is because some developers used this to find occurrence of a string inside another string. However, “.” is treated as wildcard in this function. So, if this function is used as sanitisation check, you can simply bypass it by inputting “.”. Checkout Filedescryptor’s hackerone report: https://hackerone.com/reports/129873
|
||||||
|
- Endpoints & params
|
||||||
|
- Use [LinkFinder](https://github.com/GerbenJavado/LinkFinder) & [JS Miner](https://github.com/PortSwigger/js-miner).
|
||||||
|
- Vuln libs & deps
|
||||||
|
- Use [Retire.js](https://retirejs.github.io/retire.js/) and [NPM](https://snyk.io/advisor/) (scroll down to security section > all versions link).
|
||||||
|
- Cloud URLs
|
||||||
|
- Use [JS Miner](https://github.com/PortSwigger/js-miner).
|
||||||
|
- Subdomains
|
||||||
|
- Use [JS Miner](https://github.com/PortSwigger/js-miner).
|
||||||
|
- Logic Flaws
|
||||||
|
- Gain situational awareness:
|
||||||
|
- `use strict;`?
|
||||||
|
- Grep for client-side controls:
|
||||||
|
- disable, enable, hidden, hide, show
|
||||||
|
- catch, finally, throw, try
|
||||||
|
- input, validate, verify, valid, correct, check, confirm, require, ..
|
||||||
|
- Grep for non-primatives:
|
||||||
|
- function , =>
|
||||||
|
- class
|
||||||
|
### Dynamic Analysis
|
||||||
|
|
||||||
|
References
|
||||||
|
- https://www.youtube.com/watch?v=_v8r_t4v6hQ
|
||||||
|
- https://blog.nvisium.com/angular-for-pentesters-part-1
|
||||||
|
- https://blog.nvisium.com/angular-for-pentesters-part-2
|
||||||
|
|
||||||
|
Tools
|
||||||
|
- https://portswigger.net/burp/documentation/desktop/tools/dom-invader
|
||||||
|
|
||||||
|
#### Less Used References
|
||||||
|
- https://cyberchef.org/
|
||||||
|
- https://olajs.com/javascript-prettifier
|
||||||
|
- https://jshint.com/
|
||||||
|
- https://github.com/jshint/jshint/
|
||||||
|
|
||||||
## NodeJS
|
## NodeJS
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user