Javascript and actionscript Tutorial recommendations

Viewing 6 reply threads
  • Author
    Posts
    • #5351
      T_Bone
      Participant

      Ok, so some of you guys will probably have seen some of my posts… basically I am a newbie Pen Tester and have predominantly starting performing web app assessments.

      Unfortunately I don’t have a development background, mainly sys admin and therefore am not up to speed with scripting languages.  Now I have decided to learn perl eventually but need a quick understanding of javascript and actionscript as I am not entirely sure what to look for when looking for XSS when the standard alert functions do not work.  Don’t get me wrong I have noticed that the standard does still get executed a lot on sites but need to get a better understanding  of Javascript and how to look for the more discreet vulnerabilities?

      When decompiling flash files I generally look for Look for encryption algorithms and salts, directories you can access and enumerate, crossdomain.xml file for * as the domains it can use any more?
      Any help would be appreciated?

      Cheers

    • #33848
      Xen
      Participant

      Check out w3schools.com

      Some websites employ filters in which case the standard alert dialog will not work. You will then have to try various evasion techniques.
      eg.alert(‘xss’) So if one gets blocked the other passes through.

      Cheat sheets:http://ha.ckers.org/xss.html

    • #33849
      secureseve
      Participant

      This does not have much to do with learning javascript or actionscript (but the aforementioned site:w3schools is very good) but have you read The Web Application Hacker’s Handbook? It’s really good and in depth, and you said that you are starting new with webapp testing. Very robust and if you read a chapter at a time and apply what you learned on a vuln site, it really sticks in your head. In your case, maybe you can make mock-up web apps using javascript/actionscript and try and apply what you learned from that chapter in the book. 2 birds, 1 stone lol.

    • #33850
      T_Bone
      Participant

      @ secureseven

      Actually I am in the process of reading through the Web Application Hackers Handbook at present.  I have been performing tasks on a list of vulnerable sites but havent yet got to the “Attacking Other users” chapter which deals with xss… ok ill be patient and will be sure to check out w3schools.

    • #33851
      UNIX
      Participant

      Have you looked at the WebGoat Project?

    • #33852
      dynamik
      Participant

      While this isn’t a tutorial, you might have some fun working through the exercises here: http://www.hackthissite.org/

    • #33853
      secureseve
      Participant

      Another one is : http://google-gruyere.appspot.com/#0__jarlsberg
      they renamed jarlsberg to gruyere though, but same thing, just with revisements.

Viewing 6 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2020 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?