JavaScript leads to Admin
作者通过分析目标子域名的JavaScript文件和使用工具如Katana和Waybackurls进行信息收集,手动审查JavaScript代码并结合工具获取历史信息,最终发现了安全漏洞。 2025-8-25 05:44:6 Author: infosecwriteups.com(查看原文) 阅读量:10 收藏

From JavaScript analysis to Admin JWTs.

SIDDHANT SHUKLA

Read for Free…

Namikaze Minato

🐺Hunters,

I hope my bug bounty write-ups are helpful and easily understandable for you, even though you’re a beginner in Bug Hunting.

Introduction

I was hunting on my primary target and I randomly picked a subdomain of my target. After taking a quick look around the subdomain, I started working on this subdomain.

Initial Recon

I started with taking a look on source code of page and in the meantime, I started Katana for fetching javascript file from source code.

katana -u sub.target.com -d 5

While Katana working, I started opening the javascript file manually from the source code.

I gave waybackurls a chance to give me interesting info about this subdomain.

Tool and Extension


文章来源: https://infosecwriteups.com/javascript-leads-to-admin-f7afecc21d02?source=rss----7b722bfd1b8d---4
如有侵权请联系:admin#unsafe.sh