10

You could use some tools to view what gets sent from your browser to the web app and deduce how to "emulate" this behavior. A network sniffer would be the most useful here. Wireshark (especially it's Follow Stream feature)for example. Also , some browser plugins can be useful, for example Firebug, TamperData and Poster. Appart from that, it's just the ...


9

Somebody at XKCD fora pasted a link to this gist which contains a deobfuscated and annotated source along with some explanations: The main part of Javascript that drives xkcd's "Time" comic (http://xkcd.com/1190/), deobfuscated and annotated. The bulk of the script seems to be an implementation of EventSource - which, while important, is not terribly ...


8

Both Firefox and Chrome have useful debugging tools to help you find out more information about scripts relating to a behavior. I'll be explaining mostly in Chrome as their default debug tools are more extensive As a start, you can usually use Right Click->Inspect Element to find out information about an element quickly. However this does not appear to ...


7

Install Wappalyzer for Chrome or Firefox. If you want to know how it works, the source code is available.


6

In addition to the mentioned tools, I'd like to point out httpry, which is based on libpcap (like tcpdump and WireShark) but aimed at only listening to and listing HTTP traffic. Fiddler is another tool, albeit not FLOSS, that is up for the job just like the Firefox "Tamper Data" add-on. Remko also mentioned it in his comment, but I think it needs to be ...


3

radare2 -c='H' <binary> can run radare2 with web interface. I guess you are using apt-get package manager for installing radare2, r2 deb package has a bit problem (Web interface files aren't available in deb version), It's better to install the latest version of radare2 from git.


3

youtube-dl is a nice program to download media content from a lot of websites, including twitter (and despites program name). It is open source, studying it can help understand how to retrieve the correct URLs and various other stuff (media quality, etc…)


3

You were looking at the wrong piece of code. Twitter features lightly obfuscated javscript. Bring it to order and you'll receive something like this: { "duration": 55322, "scribe_widget_origin": true, "heartbeatEnabled": false, "video_url": "https:\/\/video.twimg.com\/ext_tw_video\/823648834102272000\/pu\/pl\/BZiFV49f1BCX2JkK.m3u8", "disable_embed": "0", "...


3

If what you see rendered on the page is sufficient, then just save the complete page via your browser and modify what you want changed. If you want to be more granular about seeing what the page is pulling in, press F12 in your browser to bring up the developer tools. The "Sources" tab will show you files that are being loaded and from where. This can help ...


3

The two vertical bars hints towards 3 separate parts of the cookie. It seems that the first part is a base64 encoded json object. For the first part of the cookie no. 1 that would be: eyJ0YWxrX3N0YXRlIjowfQ\075\075 which decoded is: {"talk_state":0} nb: each "\075" is the unicode value for ascii character "K". Post login, the first part becomes: {"...


3

The way to do it is using web scraping techniques. Using sniffers and proxies is overkill if you can access the web page/resource with a browser. In this case you only need to automate what the user does within the browser and using tools like Chrome Developer Tools for inspecting the HTML and AJAX connections. I've written several articles on this subject ...


2

You can use a profiler and debug tool in your browser to examine the website. Webkit browsers (like Google chromium) have those build in. Firefox has a good plugin called firebug. With the profiler you can see which functions are called how often, which can give you an idea where to look. Then with the debugger you can set break points in the javascript ...


2

Fiddler learn to love it.. It provides an easy to use interface for capturing requests/responses to the intended sites. Essentially you need to: Make the request you want to automate using your browser. Use Fiddler to capture these requests and investigate them. (Is it a POST or GET? Is there a CSRF token? What variables map to the input I provided etc..)...


2

The answer is embarrassingly simple. Simply remove the /web part of the URL so you end up with something like this: http://music.163.com/api/search/get/ and you're good to go.


2

It appears to me that the payload contains no instructions but just addresses of the existing ROP gadgets in the DLLs specific to the system being exploited. Try looking up the addresses in the webserver process' memory and disassemble them. Alternatively, attach a debugger and put breakpoints on some of the possibly invoked functions to see how they're ...


1

Unfortunately, knowledge of JS probably isn't going to help. The HTML passes along the uploaded file to the cgi-bin/maintenance.cgi file which is a compiled ARM BE8 binary that's a bit more work to analyze than just looking at some javascript. After a very brief look, there is an RSA public/private key pair embedded in the binary that might be useful for ...


1

Sounds like it could be data coming from the server via an AJAX call, where they perhaps have a service that fetches a message (at random?) from within an array of messages like that. If it is, then assuming you're in Chrome: Click the Network tab. Click the XHR button. If you do not see it, then you'll need to click the Filter icon first. Make sure the ...


1

Yes you can. Original post is here. Explication : In your link : https://twitter.com/i/videos/823649890379120640?embed_source=facebook You can see a JSON with some informations. "statusTimestamp":{"local":"21:53 - 23 janv. 2017"} "user":{"screen_name":"VinePhilly" ...} "tweet_id":"823649890379120640" So you can access to the profile of the owner with ...


1

If you want to get the whole listing of updates, first you should write an xpath to get the uids of each download button, you should get a bunch of uids like xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx After that, POST to https://www.catalog.update.microsoft.com/DownloadDialog.aspx with [{"size":0,"languages":"","uidInfo":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","...


1

You may be able to reverse engineer the Javascript, CSS, and HTML, but not PHP or ASP. Using PHP as an example, if you have a command echo "foo";, the echo code gets executed on the server itself, and you see only the "foo" in the HTML you get. If you want to get PHP, you should test the functionality of the webpage, and hand-code the PHP accordingly. You ...


1

You can get pretty close, but if the site uses PHP, ASP.NET, or some other form of server-side html rendering, you'll never be able to completely reproduce a copy of it. This is because that server-side rendering code is just that, only on the server, and it is never sent down to the browser. But if you want to ignore all that, you can certainly assume the ...


1

Googling brought me this: http://www.tutorialspoint.com/ruby-on-rails/rails-directory-structure.htm demo/ ..../app ......../controller ......../helpers ......../models ......../views ............../layouts ..../components ..../config ..../db ..../doc ..../lib ..../log ..../public ..../script ..../test ..../tmp ..../vendor README Rakefile


Only top voted, non community-wiki answers of a minimum length are eligible