JavaScript for hackers, Learn to think like a hacker, Heyes G., 2024

JavaScript for hackers, Learn to think like a hacker, Heyes G., 2024.
    
Фрагмент из книги.
JavaScript has always been my passion, I’m fascinated by ways to help me understand JS further. You can often see me tweeting about ways to call functions without parentheses, insane XSS vectors and general ways to find deeper ways of understanding a particular feature. I’m often asked how a tweet can be used to apply to a WAF bypass or browser exploit. For me this isn’t important, sure you could use ways to call JavaScript functions without parentheses to bypass WAFs but the point of my tweets is often to rapidly gain knowledge that could be applied later.




The truth.
When it comes to fuzzing it’s often thought that you use it to discover exploitable vulnerabilities or crashes. Certainly you can use fuzzing for that and I have found vulnerabilities in the past but you can also use fuzzing to find browser behaviour and this is what this chapter is about. Fuzzing will save you a lot of time and help you build your JavaScript knowledge very quickly. It’s often tempting to look at a specification for your source of truth on a particular JavaScript behaviour, this is an incorrect mindset because different browsers might have their own quirks that didn’t follow the specification or they could be implemented incorrectly. I’m not saying don’t use the specification, I’m just saying don’t believe it and use fuzzing to discover the truth.

My first foray into behavioural fuzzing was to find characters that were allowed in a JavaScript protocol URL. I started off creating a JavaScript URL inside an anchor href attribute and was manually injecting HTML entities and hovering over the link to see if it was still the JavaScript protocol. I thought to myself there has got to be a better way. At the time I thought the best way to do this would be in a server side programming language like PHP. So I constructed a fuzzing tool that looped through characters in chunks and reported the results.

Contents.
l: Chapter one - Introduction.
1.1: About the author.
1.2: The passion.
1.3: Environment.
1.4: Set a goal.
1.5: Fuzzing.
1.6: Persistence and luck.
1.7: Social media.
1.8: The basics.
1.9: Summary.
2: Chapter two - JavaScript without parentheses.
2.1: Calling functions without parentheses.
2.2: Calling functions with arguments without parentheses.
2.3: Throw expressions.
2.4: Tagged templates.
2.5: Has instance symbol.
2.6: Summary.
3: Chapter three - Fuzzing.
3.1: The truth.
3.2: Fuzzing JavaScript URLs.
3.3: Fuzzing HTTP URLs.
3.4: Fuzzing HTML.
3.5: Fuzzing known behaviours.
3.6: Fuzzing escapes.
3.7: Summary.
4: Chapter four - DOM for hackers.
4.1: Where’s my window?.
4.2: Scope of a HTML event.
4.3: DOM clobbering.
4.4: Summary.
5: Chapter five - Browser exploits.
5.l: Introduction.
5.2: Firefox incorrect handling of cross origin URLs.
5.3: Safari assignments to cross origin hostnames.
5.4: Internet Explorer full SOP bypass.
5.5: Chrome partial SOP infoleak.
5.6: Safari full SOP bypass.
5.7: Opera SOP bypass.
5.8: Summary.
6: Chapter six - Prototype pollution.
6.1: Introduction.
6.2: Client-side prototype pollution.
6.3: Server-side prototype pollution.
6.4: Summary.
7: Chapter seven - Non-alphanumeric JavaScript.
7.1: Writing non-alphanumeric JavaScript.
7.2: Non-alpha without parentheses.
7.3: The six character wall.
7.4: Infinity and beyond.
7.5: Summary
8: Chapter eight - XSS.
8.1: Closing scripts.
8.2: Comments inside scripts.
8.3: HTML entities inside SVG script.
8.4: Script without closing script.
8.5: Window name payloads.
8.6: Assignable protocol.
8.7: Source maps to create pingbacks.
8.8: New redirection sink.
8.9: JavaScript comments.
8.10: Newlines.
8.11: Whitespace.
8.12: Dynamic imports.
8.13: XHTML namespace in XML.
8.14: SVG uploads.
8.15: SVG use elements.
8.16: HTML entities.
8.17: Events.
8.18: XSS in hidden inputs.
8.19: Popovers.
8.20: Summary.
9: Credits.



Бесплатно скачать электронную книгу в удобном формате, смотреть и читать:
Скачать книгу JavaScript for hackers, Learn to think like a hacker, Heyes G., 2024 - fileskachat.com, быстрое и бесплатное скачивание.

Скачать файл № 1 - pdf
Скачать файл № 2 - epub
Скачать файл № 3 - mobi
Ниже можно купить эту книгу, если она есть в продаже, и похожие книги по лучшей цене со скидкой с доставкой по всей России.Купить книги


Скачать - epub - Яндекс.Диск.

Скачать - mobi - Яндекс.Диск.

Скачать - pdf - Яндекс.Диск.




Теги: учебник по программированию :: программирование :: Heyes