How to Reveal Saved Browser Passwords with JavaScript Injections « Null Byte :: WonderHowTo

JavaScript is the language of the internet. It is what allows us to create dynamic, interesting webpages that are fast, web-based applications and so much more. The primary use of JavaScript is to write functions that are embedded in or included fromHTMLpages and that interact with theDocument Object Model(DOM) of the page. This is the magic that allows all of what we see to happen, and for our browser to be manipulated.What Is JavaScript Used For?Pop up windows. A new window with programmatic control over the size, position, and attributes.Validating input values of a web form to make sure that they are acceptable before being submitted to the server.Changing images as the mouse cursor moves over them in real-time.Creating cookies to save important browser information.Saving browser preferences.Entire browser webkits.Anonymous redirects.Real-time website changes.Command execution based on chronology.Many more.As you can see, JavaScript controls a lot of what we see on the internet. However, since it can also control our browser at such a low level, we can manipulate forms and webpages to do things that they weren't normally intended for. Today inNull Byte, we are going to do a cool, quick JavaScript hack that can reveal browser passwords that are stored by manipulating the browser.The CodePaste this code into the URL field in your browser to reveal stored passwords (you must be at a website the shows the asterisks on the screen):javascript: var p=r(); function r(){var g=0;var x=false;var x=z(document.forms);g=g+1;var w=window.frames;for(var k=0;k<w.length;k++) {var x = ((x) || (z(w[k].document.forms)));g=g+1;}if (!x) alert('Password not found in ' + g + ' forms');}function z(f){var b=false;for(var i=0;i<f.length;i++) {var e=f[i].elements;for(var j=0;j<e.length;j++) {if (h(e[j])) {b=true}}}return b;}function h(ej){var s='';if (ej.type=='password'){s=ej.value;if (s!=''){prompt('Password found ', s)}else{alert('Password is blank')}return true;}}Now, as a fun little game, who can tell me why it does it? Leave comments in theforums! Also, come say hi onTwitterand in theIRC! We have loads of new members who idle frequently.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicensePhoto byFreddy The BoyRelatedHow To:Reveal Saved Website Passwords in Chrome and Firefox with This Simple Browser HackHacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHow To:Write an XSS Cookie Stealer in JavaScript to Steal PasswordsHow To:Hack Your Firefox User Agent to Spoof Your OS and BrowserHow To:Hack Your Roommate! How to Find Stored Site Passwords in Chrome and FirefoxHow To:Hack Forum Accounts with Password-Stealing PicturesHow To:Inject Coinhive Miners into Public Wi-Fi HotspotsHow To:Use BeEF and JavaScript for ReconnaissanceHow To:Protect Others from Accessing Saved Password on Google ChromeSQL Injection 101:Database & SQL Basics Every Hacker Needs to KnowNews:8 Tips for Creating Strong, Unbreakable PasswordsHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How To:Turn JavaScript on in Internet ExplorerHow To:Simply Gather Saved Passwords (Quick Tutorial)Hack Like a Pro:How to Hack Facebook (Facebook Password Extractor)How To:Enable JavaScript and Cookies in OperaHow To:Hack Web Browsers with BeEF to Control Webcams, Phish for Credentials & MoreHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:Manage Stored Passwords So You Don't Get HackedHow To:Use JavaScript Injections to Locally Manipulate the Websites You VisitGoodnight Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker TrainingNews:Get YouTube's New Layout Today with a Simple JavaScript HackHow To:Carve Saved Passwords Using CainHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsForbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsHow To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)Goodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingHow To:Chrome Shares Your Activity with Google - Here's How to Use Comodo Dragon to Block ItNews:Easy Skype iPhone Exploit Exposes Your Phone Book & MoreHow To:Get the New Google Navigation MenuAtomic Web:The BEST Web Browser for iOS DevicesHow To:JavaScript Codecademy TutorialHow To:Access Wikipedia During Today's SOPA BlackoutGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingNews:3 Unique Alternative Web Browsers for Your iOS DeviceHow To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseNews:The Homepage of jQueryNews:Fun Way to Learn JavaScript Basics!Goodnight Byte:Coding a Web-Based Password Cracker in PythonMastering Security, Part 1:How to Manage and Create Strong Passwords