Javascript
secretKEY - Endpoints - Subdomains
Mahmoud M. Awali
@0xAwali
Workflow Of Javascript Files
attacker
JS URLs Monitoring Secret Keys
Subdomains
Endpoints
Host JS Files
Note
When Parsing JS For Endpoints , Please Keep Your Eyes Open
● Tweet
/ Root Directory
. This Location
.. Up A Directory
./ Current Directory
../ Parent Of Current Directory
../../ Two Directories Backwards
My Methodology
attacker
Try To Extract All The Javascript Files From A Set Of Given Urls
By Using Tools e.g. getJS
root@mine:~#./getJS --complete --header "Auth: token" --input [Link] --output [Link]
" --complete " Complete The URLs e.g. [Link]
" --header "Auth: token" " Custom Request Header
" --input [Link] " Input File With URLs
" -output [Link] " The File Where To Save The Output
My Methodology
attacker
Try To Extract All The Javascript Files From A Set Of Given Urls
By Integration Tools e.g. gau AND subJS
root@mine:~#cat [Link] | gau -subs | subjs -ua "Value-User-Agent-Header" | tee -a [Link]
" jau -subs " Fetches URLs From AlienVault's And Wayback Machine Include Subdomains Of Target
" -ua "Value-User-Agent-Header" " Value Of User-Agent Header To Send In Requests
" | tee -a [Link] " Save The Output
My Methodology
attacker
Try To Extract All The Javascript Files From A Set Of Given Urls By Using One-Liner
Command e.g. Integration Tools e.g. gospider , httpx , subJS AND anew
● Tweet
Steps to produce :-
1 - Open Your Terminal
2 - Write This Command
xargs -I@ -a [Link] -P10 sh -c 'gospider -a -d 4 -t 3 -c 50 -s
@ | tr "[] " "\n" | grep -oE "(/\*([^*]|(\*+[^*/]))*\*+/)|(.*)|(//.*)" | httpx
-silent -threads 200 | subjs -c 100 -t 5 | anew subjsUrls'
My Methodology
attacker
Try To Extract All The Endpoints From Javascript URL OR File
By Using Tools e.g. LinkFinder
root@mine:~#cat [Link]
#!/bin/bash
for jsFile in `cat [Link]`
do
Python3 [Link] -o cli -i $jsFile | tee -a [Link]
done
root@mine:~#chmod +x [Link] && ./[Link]
" -o cli " Print Output to STDOUT " " -i urlJS OR [Link] " Input a Javascript URL OR File
My Methodology
attacker
Try To Extract All The Endpoints From Javascript URL OR File
By Integration Tools e.g. subJS AND JSA
root@mine:~#cat [Link] | subjs -ua "Value-User-Agent-Header" | python3 [Link] -e -v
" -ua "Value-User-Agent-Header" " Value Of User-Agent To Send In Requests
" -e " Exclude 3rd Party JS Files
" -v " Verbose Mode
My Methodology
attacker
Try To Extract All The Endpoints From Any Domain By Using One-Liner
Command e.g. One Of Those Commands
● Tweet Steps to produce :-
1 - Open Your Terminal
● Tweet 2 - Write This Command
curl -L -k -s [Link] | tac | sed "s#\\\/#\/#g" |
egrep -o "src['\"]?\s*[=:]\s*['\"]?[^'\"]+.js[^'\"> ]*" | awk -F '//'
'{if(length($2))print "[Link] | sort -fu | xargs -I '%' sh -c "curl
-k -s \"%\" | sed \"s/[;}\)>]/\n/g\" | grep -Po
\"(['\\\"](https?:)?[/]{1,2}[^'\\\">
]{5,})|(\.(get|post|ajax|load)\s*\(\s*['\\\"](https?:)?[/]{1,2}[^'\\\">
]{5,})\"" | awk -F "['\"]" '{print $2}' | sort -fu
My Methodology
attacker
Try To Extract All The Endpoints From Any Javascript File By Integration
Tools e.g. js-beautify AND CyberChef
● Tweet
Steps to produce :-
1 - Open Your Terminal
2 - Write This Command
wget [Link]
js-beautify [Link] > [Link]
3 - Copy Content Of [Link] To CyberChef
My Methodology
attacker
Try To Extract All Subdomains From Any Domain By Using Tools e.g. subscraper
root@mine:~#python3 [Link] -u URL -v -o [Link]
" -u URL " URL Of Target e.g. [Link]
" -v " Enables Verbosity
" -o [Link] " File Where To Save Subdomains
My Methodology
attacker
Try To Extract All The Endpoints And Subdomains From Any Domain
By Using Tools e.g. JSFinder
root@mine:~#python3 [Link] -u URL -c "COOKIE-Value" -d -ou [Link] -os [Link]
" -u URL " URL Of Target e.g. [Link]
" -c "COOKIE-Value" " Value Of Cookie Header To Send In Requests
" -d " Rescan Every URL You Will Find It aka Deep Find
" -ou [Link] " File To Save Paths " -os [Link] " File To Save Subdomains
My Methodology
attacker
Try To Scan Javascript URL File To Extract Tokens By Using
Tools e.g. SecretFinder
root@mine:~#python3 [Link] -i [Link] -H 'Header: Value' -o [Link]
" -i [Link] " Input a Javascript URL From [Link]
" -H 'Header: Value' " Custom Request Header
" -o [Link] " Save Output To [Link]
My Methodology
attacker
Try To Scan Javascript URL File By Using Tools e.g. JScanner
root@mine:~#cat [Link] | JScanner --- -o [Link] -t 10
" --- " Input a Javascript URL From STDIN
" -o [Link] " Save Output To [Link]
" -t 10 " Number Of Threads
My Methodology
attacker
Try To Analyze Javascript Files From Your Command Line e.g. js-beautify [Link]
> [Link] && grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" [Link] | sort -u
● Tweet
Steps to produce :-
1 - Open Your Terminal
2 - Write This Command
wget [Link]
js-beautify [Link] > [Link]
grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" [Link] |
sort -u
My Methodology
attacker
Try To Search For Javascript Manually To Discover New parameters , Endpoints And
Subdomains OR References To More API Calls OR Get Dev Comments OR Tokens
● Video Steps to produce :-
● Writeup 1 - Browse Your Target e.g. [Link]
2 - Click Right , Choose View Page Source
● Writeup 3 - Press Ctrl Plus F To Display Search Box
4 - Search For Javascript Files e.g. .js
5 - Search For Certain Keywords e.g.
api , internal , url: , token , var = , // , https://
, [Link] , parameter etc
Top 15 DOM Base Open URL Parameter
attacker
location
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
● Tweet [Link]()
[Link]()
open()
[Link]
[Link]()
$.ajax()
[Link]()
[Link]()
My Methodology
attacker
Try To Execute Those Functions That Contains Sensitive Keywords e.g. key , API
Key etc In Your Browser's Console To See What They Do
● Tweet Steps to produce :-
1 - Browse Your Target e.g. [Link]
2 - Click Right , Choose View Page Source
3 - Search For Functions That Contains Certain
Keywords e.g. api , internal , url: , var = , // , https://
, [Link] , parameter etc
4 - Click Right , Choose Inspect Element (Q)
5 - Click Console , Write Your Funcion e.g.
secret() Then Press Enter
My Methodology
attacker
Try To Monitor Specific Javascript URL To Get Notification On Slack OR
Telegram If There Are Changes By Using Tools e.g. JSMon
Steps to produce :-
1 - Open File .bashrc
2 - Write Those
export JSMON_NOTIFY_SLACK=True
export JSMON_SLACK_TOKEN=token
export JSMON_SLACK_CHANNEL_ID=channel
3 - Open Your Terminal
2 - Write This Command
source .bashrc
cd path/to/jsmon/tool
crontab -e && @daily [Link]
echo "[Link] >> targets/[Link]
python3 [Link]
My Methodology
attacker
Try To Use FileChangeMonitor To Monitor JavaScript Files And Discover Endpoints
When They're Added
● Tweet
● Tweet
Thank
You
Mahmoud M. Awali
@0xAwali