Bugs & JS :A Closer Look at JavaScript for Successful Bug Hunting
Good Day!
Remember when I first started bug hunting? I used to think looking into JS files was unnecessary. Would I really find bugs in some files everyone could see, right? But after some reading, I realized I was missing out on a lot. So, I would like to share some resources,tools,tutorials and other ways
to dig more and learn about JS analysis.
Resources and Tools
As you may know, diving into JS files can be quite beneficial. It allows you to uncover hidden functionalities, credentials, API keys, paths, and more. This is especially valuable in identifying client-side vulnerabilities like XSS.
You can start and see the greatness with a short video where Tomnomnom talks about Chrome Dev Tools and shares some cool tips: Link
My way of looking into JS files is pretty simple. I read them manually to see if anything catches my eye. I use Fire Source Viewer extension for quickly viewing HTML, JavaScript and CSS and easy reading.Leave me a comment if you know better one.
For the tools I usually use two:
- JSleak , it is easy-to-use command-line tool designed to uncover secrets and links in JavaScript files
- JSecret, simple and fast tool to detect sensitive data in the source code such as javascript files or others.
echo "http://target.com" > target.txt
cat traget.txt| grep ".js$" | uniq | jsleak -l -s
cat traget.txt| grep ".js$" | uniq | jsecretNote:
grep ".js$": Looks for lines with ".js" at the end (if you do not add ‘$’ it will grep the json files also).uniq: Removes repeated lines.
Another approach I have read from one of the top 15 at H1 Jayesh is to collect URLs from Katana and waymore, then filter .js files. Downloads those js files using wget or curl and run JSluise on them.
Anyway,The more important things is to Learn the JS Fundamentals,Understanding the Document Object Model (DOM),Understand how JavaScript handles events, such as user clicks, keypresses, and form submissions. Learn how to attach event handlers to respond to these events,Ajax and Fetch API and more. I do not know a specific course teach you all but you can search and learn about every concept you want.
Also I would highly recommended this Arabic playlist talks about how to do JS Analysis using different methods.
Check out also these bug reports related to JS:
Admin account/panel takeOver and Doing actions in admin panel via DOM-based XSS, Link.
API leak in JS-file, Link.
Javascript Injection and JS bridge takeover,Link.
At the end, I am not a JS master. I simply wanted to share some helpful experiences with you. Don’t forget to take a look at my previous write-up .
I hope you find it interesting. If you do, please consider giving it a clap and following along :)
My LinkedIn Profile : anas_hmaidy
My Telegram Channel : anas_hmiady
Byy me a coffee : https://www.buymeacoffee.com/anasbetis94
