Free Tools! How to Use Developer Tools and Javascript in Webapp Pentests

Learn modern webbapp pentesting with BB King from Antisyphon

0:00 - A Shady-White Slideshow with "FREE TOOLS!" On the Sign
0:38 - The Way Back Machine
11:00 - Always Be Learning
18:01 - The Path to the Developer Tools
24:37 - Console Separately From a Window
30:40 - The Network Tab
36:23 - Storage Tab
38:20 - All The Cookies
40:38 - The Inspector Gadget Thingy
45:05 - Debugger
45:26 - Customize the Tools
45:36 - Console Tricks

Description: Like webapps, don't you? Webapps have got to be the best way to learn about security. Why? Because they're self-contained and so very transparent.

You don't need a big ol' lab before you can play with them. You can run them in a single tiny VM or even tiny-er Docker image on your laptop. And so long as you're attacking your own stuff, it's easy to stay out of trouble. You're up and running in the time it takes for a single download.

And the transparent part? Ever since "view source" in the earliest web browsers, it's been easy to see exactly what's going on in a webapp and in the browser. Every webapp you ever use has no choice but to give you the (client-side) source code! It's almost like there's no such thing as a "black box" webapp pentest, if you think about it...

Anyhow - the Developer Tools in Firefox (and Chrome) are what happens when you take "view source" and add 25 years or so of creativity and power.

We'll look at the Developer Tools in the latest Firefox with a pentester's eye. Inspect and change the DOM (Document Object Model), take screenshots, find and extract key bits of data, use the console to run Javascript in the site's origin context and even pause script execution in the debugger if things go too fast...

Black Hills Infosec Socials

Black Hills Infosec Shirts & Hoodies

Black Hills Infosec Services

Backdoors & Breaches - Incident Response Card Game

Antisyphon Training

Educational Infosec Content

#bhis #infosec

[mcgyver]

This should be watched by a lot more people. Great stuff.

[rybolov]

23:00 I take offense at "there is no XSS in APIs". =) That stuff has to be rendered someplace somewhere. Look st Single Page Applications as a good start.

[hadrineslo]

The Tangled Web is also a great book, for anyone interested in web application security.

[maxboehner]

25:56 The minified JS source code can be beautified by clicking on the {} curly braces at the bottom.

[Venkatnemala]

is it possible to fetch data form localhost using inspect element

[rybolov]

"Imager" a thing that images.