etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
download-and-scan-js.sh (6893B)
      1 #!/bin/bash
      2 # Download and scan minified JavaScript from production website
      3 
      4 set -e
      5 
      6 # Configuration
      7 WEBSITE_URL="${1:-https://djnn.sh}"
      8 OUTPUT_DIR="/tmp/downloaded-js"
      9 SCAN_RESULTS="/tmp/scan-results.txt"
     10 
     11 # Colors
     12 RED='\033[0;31m'
     13 YELLOW='\033[1;33m'
     14 GREEN='\033[0;32m'
     15 BLUE='\033[0;34m'
     16 NC='\033[0m'
     17 
     18 mkdir -p "$OUTPUT_DIR"
     19 rm -rf "$OUTPUT_DIR"/*
     20 
     21 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
     22 echo "[+] Downloading JavaScript files..."
     23 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
     24 echo ""
     25 echo -e "${BLUE}Target:${NC} $WEBSITE_URL"
     26 echo ""
     27 
     28 echo "Fetching main page..."
     29 MAIN_PAGE=$(curl -s -L "$WEBSITE_URL" || echo "")
     30 
     31 if [ -z "$MAIN_PAGE" ]; then
     32   echo -e "${RED}Failed to fetch website${NC}"
     33   exit 1
     34 fi
     35 
     36 # Extract all JS file URLs
     37 JS_FILES=$(echo "$MAIN_PAGE" | grep -oP '(?<=src=")[^"]*\.js(?=")' | grep -v '^http' || echo "")
     38 
     39 if [ -z "$JS_FILES" ]; then
     40   echo -e "${YELLOW}[!]  No JS files found in HTML. Trying alternate method...${NC}"
     41   JS_FILES=$(echo "$MAIN_PAGE" | grep -oP '(?<=src=")[^"]*(?=")' | grep '\.js$' || echo "")
     42 fi
     43 
     44 FILE_COUNT=$(echo "$JS_FILES" | wc -l)
     45 echo -e "${GREEN}Found $FILE_COUNT JavaScript files${NC}"
     46 
     47 COUNTER=0
     48 while IFS= read -r js_file; do
     49   if [ -z "$js_file" ]; then
     50     continue
     51   fi
     52 
     53   COUNTER=$((COUNTER + 1))
     54 
     55   if [[ "$js_file" == http* ]]; then
     56     FULL_URL="$js_file"
     57   else
     58     FULL_URL="${WEBSITE_URL}${js_file}"
     59   fi
     60 
     61   FILENAME=$(echo "$js_file" | sed 's/[^a-zA-Z0-9._-]/_/g' | sed 's/^_*//')
     62   if [ -z "$FILENAME" ]; then
     63     FILENAME="file_${COUNTER}.js"
     64   fi
     65 
     66   echo "  [$COUNTER/$FILE_COUNT] Downloading: $js_file"
     67 
     68   if curl -s -L -o "$OUTPUT_DIR/$FILENAME" "$FULL_URL" 2>/dev/null; then
     69     SIZE=$(wc -c < "$OUTPUT_DIR/$FILENAME")
     70     echo "      ✓ Saved as $FILENAME (${SIZE} bytes)"
     71   else
     72     echo "      ✗ Failed to download"
     73   fi
     74 done <<< "$JS_FILES"
     75 
     76 echo ""
     77 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
     78 echo "Step 2: Scanning for XSS patterns..."
     79 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
     80 echo ""
     81 
     82 > "$SCAN_RESULTS"
     83 
     84 TOTAL_ISSUES=0
     85 
     86 # Pattern 1: v-html
     87 echo "[1/6] Checking for 'v-html' usage..."
     88 V_HTML_COUNT=$(grep -r "v-html" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
     89 if [ "$V_HTML_COUNT" -gt 0 ]; then
     90   echo -e "${YELLOW}  [!]  Found $V_HTML_COUNT occurrences${NC}"
     91   echo "=== v-html occurrences ===" >> "$SCAN_RESULTS"
     92   grep -rn "v-html" "$OUTPUT_DIR" 2>/dev/null | head -20 >> "$SCAN_RESULTS" || true
     93   echo "" >> "$SCAN_RESULTS"
     94   TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
     95 else
     96   echo -e "${GREEN}  [+] Not found${NC}"
     97 fi
     98 
     99 # Pattern 2: html: true
    100 echo "[2/6] Checking for 'html: true' in tooltips..."
    101 HTML_TRUE_COUNT=$(grep -rE "html\s*:\s*(!0|true|\!0)" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
    102 if [ "$HTML_TRUE_COUNT" -gt 0 ]; then
    103   echo -e "${YELLOW}  [!]  Found $HTML_TRUE_COUNT occurrences${NC}"
    104   echo "=== html: true occurrences ===" >> "$SCAN_RESULTS"
    105   grep -rnE "html\s*:\s*(!0|true|\!0)" "$OUTPUT_DIR" 2>/dev/null | head -20 >> "$SCAN_RESULTS" || true
    106   echo "" >> "$SCAN_RESULTS"
    107   TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
    108 else
    109   echo -e "${GREEN}  ✓ Not found${NC}"
    110 fi
    111 
    112 # Pattern 3: innerHTML
    113 echo "[3/6] Checking for 'innerHTML' assignments..."
    114 INNERHTML_COUNT=$(grep -rE "\.innerHTML\s*=" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
    115 if [ "$INNERHTML_COUNT" -gt 0 ]; then
    116   echo -e "${RED}  ❌ Found $INNERHTML_COUNT occurrences${NC}"
    117   echo "=== innerHTML assignments ===" >> "$SCAN_RESULTS"
    118   grep -rnE "\.innerHTML\s*=" "$OUTPUT_DIR" 2>/dev/null | head -20 >> "$SCAN_RESULTS" || true
    119   echo "" >> "$SCAN_RESULTS"
    120   TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
    121 else
    122   echo -e "${GREEN}  [+] Not found${NC}"
    123 fi
    124 
    125 # Pattern 4: dangerouslySetInnerHTML
    126 echo "[4/6] Checking for 'dangerouslySetInnerHTML'..."
    127 DANGEROUS_COUNT=$(grep -r "dangerouslySetInnerHTML" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
    128 if [ "$DANGEROUS_COUNT" -gt 0 ]; then
    129   echo -e "${RED}  [+] Found $DANGEROUS_COUNT occurrences${NC}"
    130   echo "=== dangerouslySetInnerHTML occurrences ===" >> "$SCAN_RESULTS"
    131   grep -rn "dangerouslySetInnerHTML" "$OUTPUT_DIR" 2>/dev/null | head -20 >> "$SCAN_RESULTS" || true
    132   echo "" >> "$SCAN_RESULTS"
    133   TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
    134 else
    135   echo -e "${GREEN}  ✓ Not found${NC}"
    136 fi
    137 
    138 # Pattern 5: eval()
    139 echo "[5/6] Checking for 'eval()' usage..."
    140 EVAL_COUNT=$(grep -rE "\beval\s*\(" "$OUTPUT_DIR" 2>/dev/null | grep -v "evalScripts" | wc -l || echo "0")
    141 if [ "$EVAL_COUNT" -gt 0 ]; then
    142   echo -e "${RED}  [+] Found $EVAL_COUNT occurrences${NC}"
    143   echo "=== eval() usage ===" >> "$SCAN_RESULTS"
    144   grep -rnE "\beval\s*\(" "$OUTPUT_DIR" 2>/dev/null | grep -v "evalScripts" | head -20 >> "$SCAN_RESULTS" || true
    145   echo "" >> "$SCAN_RESULTS"
    146   TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
    147 else
    148   echo -e "${GREEN}  [!] Not found${NC}"
    149 fi
    150 
    151 # Pattern 6: v-tooltip library
    152 echo "[6/6] Checking for 'v-tooltip' library..."
    153 TOOLTIP_COUNT=$(grep -r "v-tooltip\|VTooltip" "$OUTPUT_DIR" 2>/dev/null | wc -l || echo "0")
    154 if [ "$TOOLTIP_COUNT" -gt 0 ]; then
    155   echo -e "${BLUE}  ℹ️  Found $TOOLTIP_COUNT occurrences (library detected)${NC}"
    156   echo "=== v-tooltip library ===" >> "$SCAN_RESULTS"
    157   grep -rn "v-tooltip\|VTooltip" "$OUTPUT_DIR" 2>/dev/null | head -10 >> "$SCAN_RESULTS" || true
    158   echo "" >> "$SCAN_RESULTS"
    159 else
    160   echo -e "${GREEN} [+] Not found${NC}"
    161 fi
    162 
    163 echo ""
    164 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
    165 echo "Step 3: Summary"
    166 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
    167 echo ""
    168 echo -e "${BLUE}Downloaded files:${NC} $OUTPUT_DIR"
    169 echo -e "${BLUE}Detailed results:${NC} $SCAN_RESULTS"
    170 echo ""
    171 
    172 if [ "$TOTAL_ISSUES" -eq 0 ]; then
    173   echo -e "${GREEN}[+] No XSS patterns detected in minified JavaScript!${NC}"
    174   echo ""
    175   echo "This means:"
    176   echo "  • Minification removed or obfuscated the patterns"
    177   echo "  • OR patterns aren't present in production code"
    178 else
    179   echo -e "${YELLOW}[!]  Found $TOTAL_ISSUES pattern types${NC}"
    180   echo ""
    181   echo "Review the detailed results at: $SCAN_RESULTS"
    182   echo ""
    183   echo "Note: Presence of patterns doesn't mean vulnerability."
    184   echo "Backend validation may be applied."
    185 fi
    186 
    187 echo ""
    188 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"