Javascript

secretKEY - Endpoints - Subdomains

Mahmoud M. Awali
@0xAwali
 Workflow Of Javascript Files

attacker

JS URLs Monitoring Secret Keys

Subdomains

Endpoints

Host JS Files
 Note

When Parsing JS For Endpoints , Please Keep Your Eyes Open

● Tweet
/ Root Directory
. This Location
.. Up A Directory
./ Current Directory
../ Parent Of Current Directory
../../ Two Directories Backwards
 My Methodology

attacker

Try To Extract All The Javascript Files From A Set Of Given Urls
By Using Tools e.g. getJS

root@mine:~#./getJS --complete --header "Auth: token" --input domains.txt --output out.txt

" --complete " Complete The URLs e.g. https://www.company.com/api/file.js

" --header "Auth: token" " Custom Request Header

" --input domains.txt " Input File With URLs

" -output output.txt " The File Where To Save The Output
 My Methodology

attacker

Try To Extract All The Javascript Files From A Set Of Given Urls
By Integration Tools e.g. gau AND subJS

root@mine:~#cat domains.txt | gau -subs | subjs -ua "Value-User-Agent-Header" | tee -a out.txt

" jau -subs " Fetches URLs From AlienVault's And Wayback Machine Include Subdomains Of Target

" -ua "Value-User-Agent-Header" " Value Of User-Agent Header To Send In Requests

" | tee -a out.txt " Save The Output

 My Methodology

attacker

Try To Extract All The Javascript Files From A Set Of Given Urls By Using One-Liner
Command e.g. Integration Tools e.g. gospider , httpx , subJS AND anew

● Tweet
Steps to produce :-
1 - Open Your Terminal
2 - Write This Command
xargs -I@ -a domains.txt -P10 sh -c 'gospider -a -d 4 -t 3 -c 50 -s
@ | tr "[] " "\n" | grep -oE "(/\*([^*]|(\*+[^*/]))*\*+/)|(.*)|(//.*)" | httpx
-silent -threads 200 | subjs -c 100 -t 5 | anew subjsUrls'
 My Methodology

attacker

Try To Extract All The Endpoints From Javascript URL OR File

By Using Tools e.g. LinkFinder

root@mine:~#cat extractEndpoints.sh
#!/bin/bash
for jsFile in `cat out.txt`
do
Python3 linkfinder.py -o cli -i $jsFile | tee -a newEndpoints.txt
done
root@mine:~#chmod +x extractEndpoints.sh && ./extractEndpoints.sh

" -o cli " Print Output to STDOUT " " -i urlJS OR out.txt " Input a Javascript URL OR File
 My Methodology

attacker

Try To Extract All The Endpoints From Javascript URL OR File

By Integration Tools e.g. subJS AND JSA

root@mine:~#cat domains.txt | subjs -ua "Value-User-Agent-Header" | python3 jsa.py -e -v

" -ua "Value-User-Agent-Header" " Value Of User-Agent To Send In Requests

" -e " Exclude 3rd Party JS Files

" -v " Verbose Mode

 My Methodology

attacker

Try To Extract All The Endpoints From Any Domain By Using One-Liner
Command e.g. One Of Those Commands

● Tweet Steps to produce :-

1 - Open Your Terminal
● Tweet 2 - Write This Command
curl -L -k -s https://www.comapny.com | tac | sed "s#\\\/#\/#g" |
egrep -o "src['\"]?\s*[=:]\s*['\"]?[^'\"]+.js[^'\"> ]*" | awk -F '//'
'{if(length($2))print "https://"$2}' | sort -fu | xargs -I '%' sh -c "curl
-k -s \"%\" | sed \"s/[;}\)>]/\n/g\" | grep -Po
\"(['\\\"](https?:)?[/]{1,2}[^'\\\">
]{5,})|(\.(get|post|ajax|load)\s*\(\s*['\\\"](https?:)?[/]{1,2}[^'\\\">
]{5,})\"" | awk -F "['\"]" '{print $2}' | sort -fu
 My Methodology

attacker

Try To Extract All The Endpoints From Any Javascript File By Integration
Tools e.g. js-beautify AND CyberChef

● Tweet
Steps to produce :-

1 - Open Your Terminal

2 - Write This Command
wget https://www.comapny.com/app.js
js-beautify file.js > pretty.js
3 - Copy Content Of pretty.js To CyberChef
 My Methodology

attacker

Try To Extract All Subdomains From Any Domain By Using Tools e.g. subscraper

root@mine:~#python3 subscraper.py -u URL -v -o output.txt

" -u URL " URL Of Target e.g. https://www.company.com

" -v " Enables Verbosity

" -o output.txt " File Where To Save Subdomains

 My Methodology

attacker

Try To Extract All The Endpoints And Subdomains From Any Domain
By Using Tools e.g. JSFinder

root@mine:~#python3 JSFinder.py -u URL -c "COOKIE-Value" -d -ou url.txt -os subdomains.txt

" -u URL " URL Of Target e.g. https://www.company.com

" -c "COOKIE-Value" " Value Of Cookie Header To Send In Requests

" -d " Rescan Every URL You Will Find It aka Deep Find

" -ou url.txt " File To Save Paths " -os subdomains.txt " File To Save Subdomains
 My Methodology

attacker

Try To Scan Javascript URL File To Extract Tokens By Using

Tools e.g. SecretFinder

root@mine:~#python3 SecretFinder.py -i out.txt -H 'Header: Value' -o secrets.txt

" -i out.txt " Input a Javascript URL From out.txt

" -H 'Header: Value' " Custom Request Header

" -o secrets.txt " Save Output To secrets.txt

 My Methodology

attacker

Try To Scan Javascript URL File By Using Tools e.g. JScanner

root@mine:~#cat out.txt | JScanner --- -o scan.txt -t 10

" --- " Input a Javascript URL From STDIN

" -o scan.txt " Save Output To scan.txt

" -t 10 " Number Of Threads

 My Methodology

attacker

Try To Analyze Javascript Files From Your Command Line e.g. js-beautify file.js
> pretty.js && grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" pretty.js | sort -u

● Tweet
Steps to produce :-

1 - Open Your Terminal

2 - Write This Command
wget https://www.comapny.com/app.js
js-beautify file.js > pretty.js
grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" pretty.js |
sort -u
 My Methodology

attacker

Try To Search For Javascript Manually To Discover New parameters , Endpoints And
Subdomains OR References To More API Calls OR Get Dev Comments OR Tokens

● Video Steps to produce :-

● Writeup 1 - Browse Your Target e.g. https://www.company.com

2 - Click Right , Choose View Page Source
● Writeup 3 - Press Ctrl Plus F To Display Search Box
4 - Search For Javascript Files e.g. .js
5 - Search For Certain Keywords e.g.
api , internal , url: , token , var = , // , https://
, company.com , parameter etc
 Top 15 DOM Base Open URL Parameter

attacker

location
location.host
location.hostname
location.href
location.pathname
location.search
location.protocol
● Tweet location.assign()
location.replace()
open()
domElem.srcdoc
jQuery.ajax()
$.ajax()
XMLHttpRequest.open()
XMLHttpRequest.send()
 My Methodology

attacker

Try To Execute Those Functions That Contains Sensitive Keywords e.g. key , API
Key etc In Your Browser's Console To See What They Do

● Tweet Steps to produce :-

1 - Browse Your Target e.g. https://www.company.com
2 - Click Right , Choose View Page Source
3 - Search For Functions That Contains Certain
Keywords e.g. api , internal , url: , var = , // , https://
, company.com , parameter etc
4 - Click Right , Choose Inspect Element (Q)
5 - Click Console , Write Your Funcion e.g.
secret() Then Press Enter
 My Methodology

attacker

Try To Monitor Specific Javascript URL To Get Notification On Slack OR

Telegram If There Are Changes By Using Tools e.g. JSMon

Steps to produce :-
1 - Open File .bashrc
2 - Write Those
export JSMON_NOTIFY_SLACK=True
export JSMON_SLACK_TOKEN=token
export JSMON_SLACK_CHANNEL_ID=channel
3 - Open Your Terminal
2 - Write This Command
source .bashrc
cd path/to/jsmon/tool
crontab -e && @daily jsmon.sh
echo "https://www.company.com/file.js" >> targets/company.com
python3 jsmon.py
 My Methodology

attacker

Try To Use FileChangeMonitor To Monitor JavaScript Files And Discover Endpoints

When They're Added

● Tweet
● Tweet
 Thank
You
Mahmoud M. Awali
@0xAwali