JS Miner: Burp Suite Extension

-

JS Miner: Burp Suite Extension 


JS Miner is an extension for Burp Suite, a popular web security testing framework, which enhances the initial reconnaissance phase of a security audit. By analyzing static files like JavaScript and JSON, JS Miner helps in the discovery of sensitive data, such as secrets and credentials, using Shannon entropy to reduce false positives. It also detects subdomains, cloud URLs, and checks for dependency confusion vulnerabilities by referencing the NPM JS registry. Additionally, the extension provides a JavaScript Source Mapper to reconstruct source code from map files, making it easier to identify security flaws​1​.

Integrated seamlessly into Burp Suite, JS Miner automates passive scanning while allowing for manual initiation of active scans to deeply analyze specific areas of interest. This extension stands out by offering a one-click option to dump static files from targeted websites, a valuable feature for security professionals who need to run custom patterns or analyses. With the tool's ability to identify API endpoints and its regular updates, the latest being on 20 July 2023, JS Miner is a significant asset for security practitioners looking to tighten web application defences.

CHARACTERISTICS:


The JS Miner extension for Burp Suite is characterized by its focus on enhancing the reconnaissance phase of web security testing. Its key features include:

  • Secrets and Credentials Scanning: Utilizes Shannon entropy to identify potential secrets or credentials within static files.
  • Subdomain and Cloud URL Detection: Passively scans for subdomains and cloud URLs, supporting platforms like AWS, Azure, and Google Cloud.
  • Dependency Confusion Checks: Passively detects "dependency confusion" issues by verifying against the NPM JS registry.
  • JavaScript Source Mapper: Actively and passively reconstructs source code from JavaScript Source Map files.
  • Static Files Dumping: Offers a feature to dump static files from websites for further analysis.
  • API Endpoint Finder: Searches for various API endpoints (GET/POST/PUT/DELETE/PATCH) within the application.

STEPS TO INSTALL AND HOW TO USE:

  • Download Burp Suite: Visit the official Burp Suite download page at http://portswigger.net/burp/download.html and download the version suitable for your system (Windows, macOS, or Linux).
  • Launch Burp Suite: Begin by opening Burp Suite, a versatile web vulnerability scanner and security assessment tool. You'll need Burp Suite Professional to access advanced features.

  • Access the Extender Tab: Navigate to the "Extender" tab within Burp Suite. This is where you can manage extensions and add new ones to enhance Burp Suite's functionality.

  • Install the "JS Miner" Extension: Inside the "Extender" tab, visit the "BApp Store." Search for the "JS Miner" extension and install it. This extension complements the standard scanning features, expanding your web application security testing capabilities.

  • Select Your Target Website: Head to the "Target" tab within Burp Suite. In this section, you can choose the specific website you want to scan for security vulnerabilities. Right-click on the target website and select "Run JS Auto-Mine(check everything)" This command initiates the scanning process. Passive scans are enabled by default.

  • Monitor Scanning Progress: To keep track of the scanning process and its outcomes, navigate to the "Scanner" tab in Burp Suite. Here, you'll find the "Issue Activity" section, which provides a detailed log of the scan's progression, discovered issues, and actions executed by Burp Suite during the scan.

  • Output: You can even see the output in the extender tab →JS Miner→ Output 

USES OF JS MINER:


JS Miner extension for Burp Suite is utilized for various purposes in web application security assessments:

  • Automated reconnaissance: It passively scans and identifies potentially sensitive information within static files.
  • Security auditing: Assists in detecting exposed secrets, credentials, and critical API endpoints which could be security vulnerabilities.
  • Infrastructure mapping: Reveals subdomains and cloud URLs, aiding in the understanding of the application's infrastructure.
  • Dependency analysis: Checks for "dependency confusion" issues to prevent supply chain attacks.
  • Code review: Uses JavaScript Source Mapping to facilitate the understanding of obfuscated or minified code.




Comments

Post a Comment

Popular posts from this blog

CAREER TECHNOLOGY CYBER SECURITY INDIA PVT LTD.

-
Image
CAREER TECHNOLOGY CYBER SECURITY INDIA PVT  LTD. ISO 27001:2013, ISO 9001:2015 Certified  Company         INTERNATIONALLY AUTHORISED FOR CYBER FORENSICS, CYBER SECURITY, CYBER AUDIT TRAINING & EXAM CENTER BY MILE2 CYBER SECURITY United States First ATC of Mile 2 Cyber Security in Mumbai & MIRA-BHAYANDER / VASAI-VIRAR, Since JAN 2017. Offline as well as Online batches both are available. PG accommodation for students is available. Joi n   CAREER TECHNOLOGY CYBER SE CURITY INDIA  PVT LTD.   Today  To Start Your  Career In  Cyber Security. * OUR PROFESSIONAL DIPLOMA COURSES FOR  ALL  UNDERGRADUATE ,    GRADUATE ,  AND  WORKING PROFESSIONALS* __ ______________________________________________________________________ Why do you have to choose our institute? 1. Our Diploma is Authorised by the Indian Government as well as its full copyright & Trademark by ISO. IT will help you to add Extra Technical Skills in     Your Resume. Its Contains Full Practicals Knowledge from the In
Read more

Some Dark web Links

-
Image
Here are some of the Forum/Website to visit on dark web related to cybersecurity and hacking. Before visiting this website please follow the steps to be safe on the dark web/ Deepweb. Security Steps to be taken before opening the links: First of All, To browse these dark web forums, first close all active programs and applications in your computer then start Your NordVPN or any Paid and HQ VPN that have TOR service and select Onion Over VPN Server.  Now start Tor Browser and disable Javascript. In this way, you have created a completely secure and untraceable environment for you. If you think Tor Browser gives you full anonymity then you are wrong.  Only premium VPN services can provide you fully secure and untraceable environment. I have tried my hands on many premium VPN services, and I found NordVPN beats its competitor in all features. Disclaimer ⚠ : This info are shared for educational purpose only, neither the website nor creator hold any info or liable to any
Read more

Cyber Security Audits

-
Image
 Cyber Security Audits What is Cyber Security Audit?                 A cyber audit, at its core, refers to a systematic evaluation and assessment of an organization's information systems. This evaluation is designed to identify potential vulnerabilities, non-compliance with standards, and areas of improvement in both technology and processes, all with the aim of safeguarding digital assets against potential threats. Cyber audits delve deeply into the organization's technological infrastructure, scrutinizing hardware, software, networks, and even the practices and protocols that users and administrators follow. This in-depth review allows for a holistic understanding of the current cybersecurity posture of the entity and helps in crafting more robust and resilient digital environments. The rationale behind conducting a cyber audit often stems from both internal and external pressures. Internally, management recognizes the intrinsic value of their digital assets, understanding th
Read more