Mirrors/hacktricks

Fork 0

mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 12:43:23 +00:00

p$3ud0R@nD0m 09d13e427f

Expand JavaScript Analysis

2022-09-02 00:20:58 -04:00

9.7 KiB

Raw Blame History

Code Review Tools

Support HackTricks and get benefits!

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!

Discover The PEASS Family, our collection of exclusive NFTs

Get the official PEASS & HackTricks swag

Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.

Share your hacking tricks submitting PRs to the hacktricks github repo.

General

https://www.sonarqube.org/downloads/
https://deepsource.io/signup/
https://github.com/pyupio/safety
https://github.com/returntocorp/semgrep
https://github.com/WhaleShark-Team/cobra
https://github.com/insidersec/insider

# Find interesting strings
https://github.com/s0md3v/hardcodes
https://github.com/micha3lb3n/SourceWolf
https://libraries.io/pypi/detect-secrets

JavaScript

Discovery

Burp:
- Spider and discover content
- Sitemap > filter
- Sitemap > right-click domain > Engagement tools > Find scripts
WaybackURLs:
- waybackurls <domain> |grep -i "\.js" |sort -u

Static Analysis

Unminimize/Beautify/Prettify

https://prettier.io/playground/ https://beautifier.io/

Deobfuscate/Unpack

Note: It may not be possible to fully deobfuscate.

Find and use .map files:
- If the .map files are exposed, they can be used to easily deobfuscate.
- Commonly, foo.js.map maps to foo.js. Manually look for them.
- Use JS Miner to look for them.
- Ensure active scan is conducted.
- Read 'Tips/Notes'
- If found, use Maximize to deobfuscate.
Without .map files, try JSnice:
- References: http://jsnice.org/ & https://www.npmjs.com/package/jsnice
- Tips:
  - If using jsnice.org, click on the options button next to the "Nicify JavaScript" button, and de-select "Infer types" to reduce cluttering the code with comments.
  - Ensure you do not leave any empty lines before the script, as it may affect the deobfuscation process and give inaccurate results.
Use console.log();
- Find the return value at the end and change it to console.log(<packerReturnVariable>); so the deobfuscated js is printed instead of being executing.
- Then, paste the modified (and still obfuscated) js into https://jsconsole.com/ to see the deobfuscated js logged to the console.
- Finally, paste the deobfuscated output into https://prettier.io/playground/ to beautify it for analysis.
- Note: If you are still seeing packed (but different) js, it may be recursively packed. Repeat the process.

Analyze

References: https://medium.com/techiepedia/javascript-code-review-guide-for-bug-bounty-hunters-c95a8aa7037a

Look for:

Anti-debug loading
- Angular: enableProdMode
Secrets
- Use:
  - JS Miner
  - RegHex patterns
  - gf patterns
  - Grep relevant dictionary patterns:
    - pass, user, admin
    - auth, login, sign, challenge, 2fa
    - key, apikey, api_key, api-key, jwt, token
    - secret, security, secure
    - ...
  - Manual review
- If API key found, check here for potential usage syntax: https://github.com/streaak/keyhacks.
Vuln functions
- InnerHTML() - If you found this, it means there is a potential chance for XSS if no proper sanitisation takes place. Even if your payload is sanitised, don’t worry. Trace the code to find out where the sanitisation takes place. Study it and try to get around the sanitisation.
- Postmessage() - If you have read my previous post (https://medium.com/techiepedia/what-are-sop-cors-and-ways-to-exploit-it-62a5e02100dc), you would notice that Postmessage() might lead to potential CORS issue. If the second parameter of the function set to *, you are the lucky one. Checkout my previous post to understand more about the mechanism behind.
- String.prototype.search() - This function looks normal. Why would it be a dangerous function? Well, it is because some developers used this to find occurrence of a string inside another string. However, “.” is treated as wildcard in this function. So, if this function is used as sanitisation check, you can simply bypass it by inputting “.”. Checkout Filedescryptor’s hackerone report: https://hackerone.com/reports/129873
Endpoints & params
- Use LinkFinder & JS Miner.
Vuln libs & deps
- Use Retire.js and NPM (scroll down to security section > all versions link).
Cloud URLs
- Use JS Miner.
Subdomains
- Use JS Miner.
Logic Flaws
- Gain situational awareness:
  - use strict;?
- Grep for client-side controls:
  - disable, enable, hidden, hide, show
  - catch, finally, throw, try
  - input, validate, verify, valid, correct, check, confirm, require, ..
- Grep for non-primatives:
  - function , =>
  - class

Dynamic Analysis

References

Tools

https://portswigger.net/burp/documentation/desktop/tools/dom-invader

Less Used References

NodeJS

https://github.com/ajinabraham/nodejsscan

Electron

https://github.com/doyensec/electronegativity

Python

# bandit
https://github.com/PyCQA/bandit
# pyt
https://github.com/python-security/pyt

.NET

# dnSpy
https://github.com/0xd4d/dnSpy

# .NET compilation
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe test.cs

Java

# JD-Gui
https://github.com/java-decompiler/jd-gui

# Java compilation step-by-step
javac -source 1.8 -target 1.8 test.java
mkdir META-INF
echo "Main-Class: test" > META-INF/MANIFEST.MF
jar cmvf META-INF/MANIFEST.MF test.jar test.class

Task	Command
Execute Jar	java -jar [jar]
Unzip Jar	unzip -d [output directory] [jar]
Create Jar	jar -cmf META-INF/MANIFEST.MF [output jar] *
Base64 SHA256	sha256sum [file] \| cut -d' ' -f1 \| xxd -r -p \| base64
Remove Signing	rm META-INF/.SF META-INF/.RSA META-INF/*.DSA
Delete from Jar	zip -d [jar] [file to remove]
Decompile class	procyon -o . [path to class]
Decompile Jar	procyon -jar [jar] -o [output directory]
Compile class	javac [path to .java file]

Go

https://github.com/securego/gosec

PHP

Psalm and PHPStan.

Wordpress Plugins

https://www.pluginvulnerabilities.com/plugin-security-checker/

Solidity

https://www.npmjs.com/package/solium