👹
Analyzing javascript files
What is JS?
Javascript is a client side object oriented scripting language. In essence this has
several meanings:
Client side, it runs on the computer of the client (victim)
Object oriented Programming term)
Scripting language, this means cross site scripting is also possible
Developers have used this over the years to make static websites a bit more
interactive and beautiful with things like javascript image carrousels but also XHR
requests and AJAX requests to the backend server to automatically fill in a page.
Javascript can do many things and for this reason it's of interest to us.
We can either analyze a javascript file statically (not running it) and dynamically
(debugging or running it). We will mostly focus on static analysis here.
What does a JS file contain?
Besides the regular cross site scripting sinks (locations where our XSS attack
vector is reflected in the JS we can also find several other juicy secrets in there
that we can use.
These secrets can contain but are not limited to:
New endpoints, one time i found a whole list of endpoints in the comments
Hidden parameters
API keys, sometimes they are supposed to be public though, so be careful
with these. Verify the impact before you report!
[Link]
Analyzing javascript files 1
Business logic, which we might be able to abuse like client side calculations of
prizes
Secrets/passwords
Potentially dangerous areas in the javascript code such as eval() or
setinnerhtml()
These are DOM sinks and can lead to DOM XSS
...
Attack strategy
For our attack stragey we first need to gather all the javascript files from a
website. We have several options to do this automatically for us or we can look in
the HTML source code manually but this will not catch all the JS files as some files
might be called nested (a JS file called from inside another JS file), these would
not show up in our initial manual scan.
Using BURP SUITE
For our automatic scan we will want to use burp filters later on to explore all of our
javascript files. To do this:
Open burp
Set your scope right
Explore the site manually by clicking around
Open the burp site map tab
Click on the "Filter" Box
Click on the "Script" checkbox and make sure it's the only one active under
"Mime type"
Under "Filter by file extension" , click "Show only" and fill in JS in the box
Analyzing javascript files 2
If you have burp suite pro, you can also right click on your target in the site map
and under the engagement tools you will the option to "Find scripts". This will
effectively do the same after exploring your target manually but the results will be
displayed prettier.
Analyzing javascript files 3
Using waybackurls
Install waybackurls, using this tool we can also grep for any JS files that might not
be linked anymore but still online.
go get [Link]/tomnomnom/waybackurls
waybackurls [Link] | grep "\.js" | uniq | sort
Analyzing javascript files 4
Defense mechanisms
Developers use a range of defense mechanisms to hold us off but that's okay. We
can get around those by being dilligent and making sure that we take our time.
JS minification
This is just removing all the whitespaces. Can be easily undone by some
online tools like JS pretty print
JS Obfuscation
This is where developers will make it intenionally hard to read the
code for humans but machines don't have any problem reading this
code. This is harder to decipher but with some dilligence it can be
done.
[Link]
protect-javascript
[Link] (doesn't seem to work
well)
JS Chunking
This is where the developers chops up the JS into little pieces that all
reference eachother. Very annoying to get arround and it's just hard
work puzzling together the code
If we are trying to defeat these mechanisms it might help to set up a replica of you
targets environment and to run the code statically.
Analyzing javascript files 5