Head of Cybersecurity Services.
HTTP/418
Joined July 2023
- Tweets86
- Following1
- Followers2.3K
- Likes39
Secure Area ( old NETPLUS )
Persian WSTG 4.2 OWASP Content.
-> secure-area.vercel.app/
Third-Party domains
(() => {
const domains = new Set();
const add = value => {
try {
const url = new URL(value, location.href);
if (
url.hostname &&
url.hostname !== location.hostname
) {
domains.add(url.hostname.toLowerCase());
}
} catch {}
};
document.querySelectorAll("[src],[href]").forEach(el => {
add(el.src || el.href);
});
performance.getEntriesByType("resource")
.forEach(r => add(r.name));
const result = [...domains].sort();
console.table(result);
copy(result.join("\n"));
return result;
})();
Extract Sensitive Path
(() => {
const paths = new Set();
const regex =
/["'`](\/[^"'`\s]{2,150})["'`]/g;
const scan = text => {
if (!text) return;
for (const m of text.matchAll(regex)) {
const path = m[1];
if (
/\/(admin|administrator|dashboard|api|api-docs|swagger|graphql|debug|internal|private|backup|config|test|dev|staging|auth|login|upload|download|export|import|management)/i
.test(path)
) {
paths.add(path);
}
}
};
scan(document.documentElement.outerHTML);
document.querySelectorAll("script").forEach(s => {
scan(s.textContent);
});
const result = [...paths].sort();
console.table(result);
copy(result.join("\n"));
return result;
})();
Extract all JS Files with Console Tab
(() => {
const js = new Set();
document.querySelectorAll('script[src]').forEach(s => {
try {
js.add(new URL(s.src, location.href).href);
} catch {}
});
performance.getEntriesByType("resource")
.filter(r => /\.js(?:\?|$)/i.test(r.name))
.forEach(r => js.add(r.name));
const result = [...js].sort();
console.table(result);
copy(result.join("\n"));
return result;
})();
