JavaScript for Hackers.pdf
- 1. JavaScript for Hackers JOAS ANTONIO
- 2. Details This pdf is based on content from PenTest Academy and other professionals, credits will be placed on the respective pages. LinkedIn: https://www.linkedin.com/in/joas-antonio-dos-santos
- 3. Courses JavaScript for PenTest https://www.pentesteracademy.com/course?id=11 https://www.youtube.com/watch?v=FTeE3OrTNoA https://www.youtube.com/watch?v=HptfL5WRYF8 https://www.youtube.com/watch?v=-UPRQBQV5Lo https://www.youtube.com/watch?v=mG0Sm0GQ6ck&list=PL9w1Wxb9TxnO4_0 j5NJ7zYG0WBpM8UDLs https://www.udemy.com/course/ethical-hacking-with-python-javascript-and-kali- linux/
- 4. XSS for PenTest – Boku7 Github: https://github.com/boku7 The codes shown in the next slides were created by boku7
- 8. XSS-XHR.js https://github.com/boku 7/XSS-Clientside- Attacks/blob/master/XS S-XHR.js
- 26. JavaScript Doom XSS Source: An input that could be controlled by an external (untrusted) source.
- 27. JavaScript Doom XSS Sink: A potentially dangerous method that could lead to a vulnerability. In this case a DOM Based XSS.
- 28. Awesome Payloads
- 29. Awesome Payloads Some less detected event handlers
- 30. Awesome Payloads Some HTML Tags that you will be using https://github.com/s0md3v/AwesomeXSS
- 31. Awesome Payloads Some HTML Tags that you will be using https://github.com/s0md3v/AwesomeXSS
- 32. JSHacking – Ankur8931 Github: https://github.com/ankur8931 The codes shown in the next slides were created by Ankur8931
- 33. JSHacking – Ankur8931 1.form-submit.js - Hijacking form submit 2.social-engg.js - Social Engineering exploit to hijack form submit and redirect to different page 3.mouse-click.js - Capturing mouse click events and redirecting to different page 4.keylogger.js - loggin keystrokes to SimpleHTTPServer running on port 9000 5.event-listener.js - Listen to form submit event and show password in the pop up alert box 6.external.js - running external js from script source to bypass any code limitation checks 7.external-noscript.js - include external javascript without using script tags 8.replace-img.js - replace old image by new image in JS 9.autocomplete-timer.js - wait for 10s and submit the form to the attacker server 10.xmlhttpreq.js - XML http request to send form submit parameters to the attacker server 11.xmlhttpreq-fetch.js - Fetch email from provided URL using XML http request 12.data-exfil.js - Exfiltration of Credit card information to the attacker server 13.csrf-token.js - Extract CSRF token and submit to web 14.csrf-token-uid.js - Extract the email using UID, and CSRF token. Display the email address on the page. 15.html-parsing.js - Parse HTML response by exploiting xss and insert addess into div result 16.multi-level-html.js - Extract credit card number via multi-level HTML documents and post to the server 17.multi-json.js - Multi level JSON parsing and displaying information in the div element result 18.multi-xml.js - Multi level XML parsing and displaying information in div element result
- 36. csrf- token.js
- 37. csrf- token.js
- 38. data-exfil.js
- 41. form- submit.js
- 42. htmlparsing.js
- 43. keylogger.js
- 44. Social-engg.js
- 45. Xmlhttpreq.js
- 49. Bug Bounty JavaScript for Hackers https://medium.com/geekculture/analysing-javascript-files-for-bug-bounty-hunters-71e2727abebe https://hackerone.com/nodejs?type=team https://thehackerish.com/javascript-enumeration-for-bug-bounty-hunters/ https://www.youtube.com/watch?v=8sfc0PlVyWA https://www.youtube.com/watch?v=nkznsNxDM5k https://www.youtube.com/watch?v=G2pWVBgCjvg https://www.youtube.com/watch?v=A3eqNoYUdGc https://www.bugbountyhunter.com/guides/?type=javascript_files https://www.securecoding.com/blog/monitoring-javascript-files-for-bugbounty/ https://infosecwriteups.com/bug-bounty-tips-tricks-js-javascript-files-bdde412ea49d https://research.securitum.com/art-of-bug-bounty-a-way-from-js-file-analysis-to-xss/
- 50. Bug Bounty JavaScript for Hackers https://bitthebyte.medium.com/javascript-for-bug-bounty-hunters-part-1- dd08ed34b5a8 https://www.youtube.com/watch?v=vUrx113ZtEw https://infosecwriteups.com/javascript-files-recon-23ac49fe6120 https://portswigger.net/daily-swig/facebook-offers-40k-for-javascript-vulnerabilities- in-bug-bounty-program https://jsoverson.medium.com/hacking-javascript-with-javascript-6adbeaba22e9