BSides Jaipur

Transcript

1. Client-Side JavaScript Analysis Sahil Dari Senior Associate Information Security eSecForte Technologies Pvt. Ltd.
3. topics we will cover… JavaScript Analysis WHAT? WHY? HOW?
4. what is JavaScript analysis?  Add-on to your regular Web Application Assessment.  Static part of the DAST.  Widen your scope of Web Application Assessment.
5. why perform JavaScript analysis?  Your scope of testing widens and the probability to find bugs increases.  You can find Hardcoded Sensitive Data, Hidden parameters, Hidden Functions, Hidden Endpoints, Encryption/Decryption keys, etc.
6. how to get JavaScript files?  By Using gau, waybackurls or other command line tools.  Output all the URLs from gau/waybackurls in a file URLs.txt  Open URLs.txt in Sublime-text  Find all URLs with .js and copy these URLs.  Open the copied URLs in your browser running BurpSuite Proxy.
10. how to get JavaScript files? contd…  By using BurpSuite Professional  Always turn on your BurpSuite proxy while navigating to your Web Application.  Do your normal Manual Testing and after you are done, Navigate to Targets > The URL in scope > Right Click > Engagement Tools > Find Scripts > Export Scripts > Save to a file.  Save all the JavaScript of the application in scope to Scipts.js.
13. how to perform JavaScript Analysis  Now we have all the JavaScript “code” curated in a single file (Scripts.js)  Open Scripts.js in Sublime-text.
14. keywords for Hardcoded Secrets  secret  password  token  key  private  pass  user  code
15. keywords for Hidden Endpoints  api  v1  v2  json  post  get  localhost  data  content
16. keywords for Hidden/Interesting Functions  reset  password  forgot  forget  admin  super  verify  encrypt/decrypt  encode/decode
17. tools for JavaScript Analysis
18. bugs I found via JavaScript Analysis  Account Take Over  AES Encryption/Decryption Keys  AWS secrets  PII Information Leaks  Hidden Endpoints
19. example (Account Take Over)
20. example (Account Take Over) contd…
21. motivation Bounty: JavaScript Analysis to XSS