Hi and welcome back to another episode on How to Hack.
So we are back again to our open web application security project, Web application penetration testing
series.
So once again, we have a look at the number of ways of inspecting a side.
And of course, in on one of our videos, we actually look at the whole customer journey looking and
inspecting about a site.
So, again, I want to highlight at the moment, you get to a site, you don't just begin injecting
different kind of payloads and running all your different scripts, running all your different injections.
The first thing you want to do is to look at how a customer would actually walk through the entire site.
So we will with the help of web developer.
So let's say I click onto the network web developer.
We can zoom a little more.
So it's easier for you to see.
So we can do a refresher reload and we can look at all the scripts that are being loaded as part of
the site.
OK, so I can zoom in a little more and we can see a number of JavaScript, so we can see runtime,
we can see vendor, Polyphemus, main, et cetera, et cetera, so we can see all these different JavaScript
kookie consent and all these different items are loaded as part of this.
Of course, we also found application programming interfaces that can also be queried.
So we see a lot of all these different data.
And one of those things is really important to understand about how websites are being structured already,
JavaScript.
So, for example, over here, if I do a right click on Main Dash two zero one five.
So again, we are trying to get our information as much as we can about the website before we launch
a specific attack.
And the purpose of doing that is so that we can bypass certain firewalls, we can bypass web application
firewall.
We can ensure that we do not trigger any kind of alarm systems.
So, again, we want to fully understand, comprehend and map out how the entire site work.
And of course, one of the best ways to understand about how Web application work is to, of course,
build it entirely by yourself and see and map how those things work.
OK, so going back to the tutorial, so over here, a main Dasht E two zero one five.
So again, it will be our job to actually inspect all this different JavaScript.
So I'm going to go ahead and copy.
All right.
I'm going to copy the URL and we'll open up a new tab and I'm going to pace it and hit, enter, indebt.
So, of course, here we have the JavaScript and of course, it has been minify.
So what do I mean by minified?
Because the whole idea is get rid of as much indentation spaces as possible so that it is significantly
can load a lot faster and you can save a lot more space in sending that data across.
OK, so all we are going to copy everything.
I'm going to copy everything to a right click copy.
I'm going to go to this site, call on Minify.
All right.
So I'm going to paste a code here and I'm going to click zoom in a little more so it's easier for you
to see.
OK, so I'm going to click on and modify it.
All right.
So this makes it more human readable so that we can dissect the segments and look at how they're actually
going to structure the JavaScript.
So I'm going to copy again, I'm going to copy the unmodified JavaScript.
I'm going to go into notepad plus plus.
So NOPEC plus plus will give us a very nice way of looking at a situation.
So I've already done that.
So I'm going to pass it over here on to notepad, blah blah so we can actually look at all this very
nice indentation.
Makes it much easier for us to analyze what is going on.
What is the purpose of the JavaScript?
What can these JavaScript do for the website?
How does it affect the customer journey?
So as I scroll down, I can see, OK, we have no functions, we have computation, we have all these
ways of redirecting users and so on and so forth.
So one of those things that we can look for is, of course, direct.
OK, so we can do a control if I'm going to go on to magnifier.
So it's easier for you to see someone open a magnifier.
I'm going to scroll over here.
So, of course, you can see that we have this.
Fine, so we can look, for example, for direct, so it could, again, be a way for us to find certain
redirection links that could have otherwise been discarded as part of the updates to the website.
So I'm going to click on Find What We Directly Phoenix so we can find like offset direction and so on,
so we can find all this different information.
Can we find more details?
Can we find things more specifically about certain links?
Can we find more items that would actually show us the redirection to a URL?
So we see a lot of direction.
So again, we can refine our searching.
So, for example, if I had to redirect, can we find something else?
So if I click Phoenix.
Look what we got here, so he says show bitcoin, QR code, and of course, I'm going to zoom in a little
more so it's easier for you to see.
And we can look over here.
There's a URL redirect to and we have this block chain dot info.
So this, again, we can see the address.
And of course, if I scroll down some more, we have the QR code and again, we are seeing all this
different data.
So again, all this redirection places at or scanned on IO and we can see the address.
So this could be payment systems and we could possibly change it.
And for example, if I look over here, use wallet and it puts an exclamation zero, what does that
mean?
What if I change zero to one?
How would it affect the customer experience of the site?
What would get loaded and what not get loaded?
So all these all the questions that you have to be asking yourself as you are inspecting and analyzing
the structure of the site and the way they're logically planning the activities, they will be executed
as part of the customer journey.
So what else can we find?
So if you go back into open Web application security project over here, somewhere close to magnify
for a moment.
OK, so we're back into the Juice Shop website.
And if you look at these, you are at a top.
So, again, if you look at Agrella top so we can see the URL here, so we can see, for example, we
have the website name, part number and slash hacks slash search.
So if I click onto left site tab and for example, if I click on customer feedback and over here we
can see Hack's Contac.
OK, so again, we are looking at all these different pages and we're thinking how are these being let
into?
What is the process?
Could it be a direction from the JavaScript?
OK, so this are the questions you have to be asking yourself all the time.
So if I go back onto the notepad plus plus in which we have the unmodified original version of the JavaScript,
so can we search specifically for those information as well?
So, for example, if we go back into the USB juice shop, so we have contact.
So if I go back into the search and I enter contact and I click on Find.
OK, so we could contact email, we so and so forth.
So are we able to find something a little more specific again?
OK, so over here.
We can find, for example, this is Log-in and so on, so forth, scoreboard.
OK.
And here we are seeing, OK, we have about we have delivery method, deluxe membership basket, Contac
photo wall.
This seems like the segment that actually has all these different addresses.
So we have an administration.
OK, can we try this?
Let's go back to the site and enter and change this to administration.
So let's go ahead and administration and hit enter.
OK, so we can see over here.
All right.
So we can look at all this different data and information.
All right.
How about trying something else?
Accounting.
All right.
How about Peyman, forget password scoreboard.
Can we see those data?
Can we see those information?
Are we able to access to those data?
So if I had to score Dashboard, can we gain access to it?
Oh, yes, we found something here.
So we found a scoreboard.
All right, so we can find all this different data by looking specifically in JavaScript, which may
be hiding some of these different pages, different lengths, different redirections.
And we can also look and think about the activities that will be executed as part of the customer journey.
All right.
So let me know what else you find from inspecting the JavaScript.
OK.
And of course, I hope you have learned something valuable in today's tutorial.
And if you like, what if just watch him to, like, share and subscribe to the channel so that you
can be kept abreast of the latest cybersecurity.
Tarryl.
Thank you so much once again for watching.