PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Introducing jsluice: The Why Behind JavaScript Gold Mining (Part 1)

bishopfox.com | blog | #open-source | #security-tools | #javascript | #web-crawling | #spa | #jsluice
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part one of the jsluice series traces how the shift from link-based HTML to JavaScript single-page apps broke classic web crawling, motivating a tool that sifts useful data from megabytes of JS.
Published
Collected

Related coverage

tool · github.com
Peach: Single-user, Local-first Personal Media Library and Management System
Offers a privacy-respecting, local-first alternative for media library indexing and playback, combining cloud-drive integration with automated scraping while keeping sensitive viewing data strictly local.
blog · bishopfox.com
Introducing jsluice: A Technical Deep-Dive for JavaScript Gold (Part 2)
A technical deep-dive into jsluice's four modes—urls, secrets, tree, and query—and how its syntax-tree analysis extracts endpoints, methods, and headers from fetch and XMLHttpRequest JavaScript.
blog · bishopfox.com
9 Red Team Tools For a Successful Red Teaming Engagement
Nine red team tools from Bishop Fox: CursedChrome for browser hijacking, Universal Loader for cross-platform in-memory loading, Overlord for infrastructure automation, and Sliver's implant framework.
blog · bishopfox.com
Lessons Learned on Brute-forcing RMI-IIOP With RMIScout
RMIScout 1.4 adds RMI-IIOP support, SSL, invoke and list modes, and a localhost bypass for attacking exposed Java RMI interfaces — plus notes on brute-forcing RMI-IIOP method signatures.
blog · bishopfox.com
The Pen Testing Tools We’re Thankful for in 2020
Bishop Fox's favorite pen-testing tools of 2020: Nuclei for fast community-driven scanning, Spyse for security-focused OSINT, Smuggler for request smuggling, GoBuster, and other standouts.
blog · bishopfox.com
GitGot Tool Release
GitGot is a semi-automated, feedback-driven Bishop Fox tool that searches public GitHub data for sensitive secrets using blacklists, fuzzy matching and the GitHub Search API.
Back