Burp suite pen tester how to#
Burp suite pen tester code#

Navigate through an application while the traffic is being sent through Burp proxy. Identifying information that may lead to discovery of security issues Gathering JavaScript filesġ.If you use Burp Suite for testing applications then there are multiple ways to gather all the JavaScript files in an application.Īt Appsecco, We follow user-driven workflow for testing web applications where we start testing by navigating the entirety of the application like an end user would do.

Burp suite pen tester code#

Making the gathered JavaScript code readable (Unminify/Deobfuscate) 3. Identifying and gathering JavaScript files in an application 2. We’ll perform static analysis by breaking it down into following steps:ġ. Components with known vulnerabilities (Outdated frameworks etc).Potentially dangerous areas in code(eval, dangerouslySetInnerHTML etc).Sensitive information (Passwords, API keys, Storage etc).Information that’ll increase the attack surface (URLs, domains etc).What to look for?Īs a penetration tester, when we are performing static analysis of client-side JavaScript, we are more or less interested in the information that will fall under following categories.

Static analysis is analysing code without executing it. We will not delve into performance analysis or functional testing. In this blog post we are particularly interested in performing static analysis to uncover security issues.

In this blog post we will look at performing static analysis of client-side JavaScript code in order to uncover potential security issues in the applications.

Burp suite pen tester how to#

It is also important for us to know what information to look for, where to look for and how to look for the information that will lead to the discovery of potential security issues in the applications. With the increased functionality/logic on the client-side, the attack surface on the client-side also increases.Īs a security tester it is essential for us to understand the attack surface of these applications. Applications built using client-side JavaScript frameworks such as AngularJS, ReactJS and Vue.js push a lot of functionality and logic to the front-end. JavaScript has become one of the most ubiquitous technologies in the modern web browsers. Static Analysis of Client- Side JavaScript for pen testers and bug bounty hunters