etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
commit 27c50ed8b65a3241d271f59cc8fdfb6b682fddfe
parent abf119aa262a81026d688495f1d2d56903789d76
Author: djnn <[email protected]>
Date: Wed, 28 Jan 2026 20:49:58 +0900

simple js scanner

Diffstat:
pentest/recon/download-and-scan-js.sh
188
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 188 insertions(+), 0 deletions(-)
diff --git a/pentest/recon/download-and-scan-js.sh b/pentest/recon/download-and-scan-js.sh
@@ -0,0 +1,188 @@
+#!/bin/bash
+# Download and scan minified JavaScript from production website
+
+set -e
+
+# Configuration
+WEBSITE_URL="${1:-https://djnn.sh}"
+OUTPUT_DIR="/tmp/downloaded-js"
+SCAN_RESULTS="/tmp/scan-results.txt"
+
+# Colors
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+mkdir -p "$OUTPUT_DIR"
+rm -rf "$OUTPUT_DIR"/*
+
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "[+] Downloading JavaScript files..."
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+echo -e "${BLUE}Target:${NC} $WEBSITE_URL"
+echo ""
+
+echo "Fetching main page..."
+MAIN_PAGE=$(curl -s -L "$WEBSITE_URL" || echo "")
+
+if [ -z "$MAIN_PAGE" ]; then
+  echo -e "${RED}Failed to fetch website${NC}"
+  exit 1
+fi
+
+# Extract all JS file URLs
+JS_FILES=$(echo "$MAIN_PAGE" | grep -oP '(?<=src=")[^"]*\.js(?=")' | grep -v '^http' || echo "")
+
+if [ -z "$JS_FILES" ]; then
+  echo -e "${YELLOW}[!]  No JS files found in HTML. Trying alternate method...${NC}"
+  JS_FILES=$(echo "$MAIN_PAGE" | grep -oP '(?<=src=")[^"]*(?=")' | grep '\.js$' || echo "")
+fi
+
+FILE_COUNT=$(echo "$JS_FILES" | wc -l)
+echo -e "${GREEN}Found $FILE_COUNT JavaScript files${NC}"
+
+COUNTER=0
+while IFS= read -r js_file; do
+  if [ -z "$js_file" ]; then
+    continue
+  fi
+
+  COUNTER=$((COUNTER + 1))
+
+  if [[ "$js_file" == http* ]]; then
+    FULL_URL="$js_file"
+  else
+    FULL_URL="${WEBSITE_URL}${js_file}"
+  fi
+
+  FILENAME=$(echo "$js_file" | sed 's/[^a-zA-Z0-9._-]/_/g' | sed 's/^_*//')
+  if [ -z "$FILENAME" ]; then
+    FILENAME="file_${COUNTER}.js"
+  fi
+
+  echo "  [$COUNTER/$FILE_COUNT] Downloading: $js_file"
+
+  if curl -s -L -o "$OUTPUT_DIR/$FILENAME" "$FULL_URL" 2>/dev/null; then
+    SIZE=$(wc -c < "$OUTPUT_DIR/$FILENAME")
+    echo "      ✓ Saved as $FILENAME (${SIZE} bytes)"
+  else
+    echo "      ✗ Failed to download"
+  fi
+done <<< "$JS_FILES"
+
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "Step 2: Scanning for XSS patterns..."
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+
+> "$SCAN_RESULTS"
+
+TOTAL_ISSUES=0
+
+# Pattern 1: v-html
+echo "[1/6] Checking for 'v-html' usage..."
+V_HTML_COUNT=$(grep -r "v-html" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
+if [ "$V_HTML_COUNT" -gt 0 ]; then
+  echo -e "${YELLOW}  [!]  Found $V_HTML_COUNT occurrences${NC}"
+  echo "=== v-html occurrences ===" >> "$SCAN_RESULTS"
+  grep -rn "v-html" "$OUTPUT_DIR" 2>/dev/null | head -20 >> "$SCAN_RESULTS" || true
+  echo "" >> "$SCAN_RESULTS"
+  TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
+else
+  echo -e "${GREEN}  [+] Not found${NC}"
+fi
+
+# Pattern 2: html: true
+echo "[2/6] Checking for 'html: true' in tooltips..."
+HTML_TRUE_COUNT=$(grep -rE "html\s*:\s*(!0|true|\!0)" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
+if [ "$HTML_TRUE_COUNT" -gt 0 ]; then
+  echo -e "${YELLOW}  [!]  Found $HTML_TRUE_COUNT occurrences${NC}"
+  echo "=== html: true occurrences ===" >> "$SCAN_RESULTS"
+  grep -rnE "html\s*:\s*(!0|true|\!0)" "$OUTPUT_DIR" 2>/dev/null | head -20 >> "$SCAN_RESULTS" || true
+  echo "" >> "$SCAN_RESULTS"
+  TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
+else
+  echo -e "${GREEN}  ✓ Not found${NC}"
+fi
+
+# Pattern 3: innerHTML
+echo "[3/6] Checking for 'innerHTML' assignments..."
+INNERHTML_COUNT=$(grep -rE "\.innerHTML\s*=" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
+if [ "$INNERHTML_COUNT" -gt 0 ]; then
+  echo -e "${RED}  ❌ Found $INNERHTML_COUNT occurrences${NC}"
+  echo "=== innerHTML assignments ===" >> "$SCAN_RESULTS"
+  grep -rnE "\.innerHTML\s*=" "$OUTPUT_DIR" 2>/dev/null | head -20 >> "$SCAN_RESULTS" || true
+  echo "" >> "$SCAN_RESULTS"
+  TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
+else
+  echo -e "${GREEN}  [+] Not found${NC}"
+fi
+
+# Pattern 4: dangerouslySetInnerHTML
+echo "[4/6] Checking for 'dangerouslySetInnerHTML'..."
+DANGEROUS_COUNT=$(grep -r "dangerouslySetInnerHTML" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
+if [ "$DANGEROUS_COUNT" -gt 0 ]; then
+  echo -e "${RED}  [+] Found $DANGEROUS_COUNT occurrences${NC}"
+  echo "=== dangerouslySetInnerHTML occurrences ===" >> "$SCAN_RESULTS"
+  grep -rn "dangerouslySetInnerHTML" "$OUTPUT_DIR" 2>/dev/null | head -20 >> "$SCAN_RESULTS" || true
+  echo "" >> "$SCAN_RESULTS"
+  TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
+else
+  echo -e "${GREEN}  ✓ Not found${NC}"
+fi
+
+# Pattern 5: eval()
+echo "[5/6] Checking for 'eval()' usage..."
+EVAL_COUNT=$(grep -rE "\beval\s*\(" "$OUTPUT_DIR" 2>/dev/null | grep -v "evalScripts" | wc -l || echo "0")
+if [ "$EVAL_COUNT" -gt 0 ]; then
+  echo -e "${RED}  [+] Found $EVAL_COUNT occurrences${NC}"
+  echo "=== eval() usage ===" >> "$SCAN_RESULTS"
+  grep -rnE "\beval\s*\(" "$OUTPUT_DIR" 2>/dev/null | grep -v "evalScripts" | head -20 >> "$SCAN_RESULTS" || true
+  echo "" >> "$SCAN_RESULTS"
+  TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
+else
+  echo -e "${GREEN}  [!] Not found${NC}"
+fi
+
+# Pattern 6: v-tooltip library
+echo "[6/6] Checking for 'v-tooltip' library..."
+TOOLTIP_COUNT=$(grep -r "v-tooltip\|VTooltip" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
+if [ "$TOOLTIP_COUNT" -gt 0 ]; then
+  echo -e "${BLUE}  ℹ️  Found $TOOLTIP_COUNT occurrences (library detected)${NC}"
+  echo "=== v-tooltip library ===" >> "$SCAN_RESULTS"
+  grep -rn "v-tooltip\|VTooltip" "$OUTPUT_DIR" 2>/dev/null | head -10 >> "$SCAN_RESULTS" || true
+  echo "" >> "$SCAN_RESULTS"
+else
+  echo -e "${GREEN} [+] Not found${NC}"
+fi
+
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "Step 3: Summary"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+echo -e "${BLUE}Downloaded files:${NC} $OUTPUT_DIR"
+echo -e "${BLUE}Detailed results:${NC} $SCAN_RESULTS"
+echo ""
+
+if [ "$TOTAL_ISSUES" -eq 0 ]; then
+  echo -e "${GREEN}[+] No XSS patterns detected in minified JavaScript!${NC}"
+  echo ""
+  echo "This means:"
+  echo "  • Minification removed or obfuscated the patterns"
+  echo "  • OR patterns aren't present in production code"
+else
+  echo -e "${YELLOW}[!]  Found $TOTAL_ISSUES pattern types${NC}"
+  echo ""
+  echo "Review the detailed results at: $SCAN_RESULTS"
+  echo ""
+  echo "Note: Presence of patterns doesn't mean vulnerability."
+  echo "Backend validation may be applied."
+fi
+
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"