How to Use JavaScript Injections to Locally Manipulate the Websites You Visit « Null Byte :: WonderHowTo

JavaScript is one of the main programming languages that the Web is built on. It talks directly to your browser and exchanges information with it in ways that HTML simply cannot. With JavaScript, you are able to access browser cookies, website preferences, real-time actions, slideshows, popup dialogs and calculators, or you create entire web-based apps. The list goes on nearly forever.We can use JavaScript ourselves—right now—in the web browser. Go ahead, type this into the address bar of your browser without a URL in it and press the enter key:javascript:alert('Hello World!');You will see a popup box that says "Hello World!". This is what's called a JavaScript injection. We took a bit of JavaScript and manipulated the Web in real-time. JavaScript injections can be used to do a number of things; You can check cookie contents, swap cookies, temporarily edit a webpage, modify web forms, and even do some malicious stuff.In thisNull ByteI'm going to be teaching you the bare bones of JavaScript injections and how to manipulate cookies and web form data.Step1Alert & Injection ChainsLet's start by using the example we used above and create a JavaScript alert.javascript:alert('Hello World!');Let's dissect that. "javascript" tells the browser we are using JavaScript, "alert" is calling the alert function and everything between "()" is the argument. In the argument, you see single quotes that indicate text strings. They can be interchanged with double quotes, just like in english, but they must be consistent. These rules are almost uniform when it comes to programming.Let's chain commands. The semicolon is the indicator of command chains. Try this one out:javascript:alert('Hello World!'); alert("Double quotes, and second alert");Because JavaScript was already specified, we only need to call the alert function again.Step2Cookie Alerts & Cookie ModificationNow we are going to check if the webpage we are on uses cookies. Then we will see if we can edit the cookies to swap login sessions.javascript:alert(document.cookie)If you see a popup with lots of jumbles of letters and things like "PHPSESSID=", that means the website is storing cookies on your computer.Let's edit something in this cookie.javascript:void(document.cookie="__mvtVariantID=tacos");In the picture above, you see that I had the "__mvtVariantID="element. I use the JavaScript injection to modify it to the word "tacos". You'll see the new element at the bottom in the picture below. This also uses the "void" function, which voids an element with whatever information you want to put over it.Now if I were logged in and had another member's cookie, I could swap our sessions using these techniques, effectively becoming that member.Step3Edit Web FormsSometimes you may want to edit a web form. A web form is when you have to "submit" something to a server, usually in logins or forgotten password forms. Let's say we have a forgot password form for some website, and this is the HTML code they used:<form action="http://www.website.com/forgotpassword.php" method="post"> <input type="hidden" name="to" value="admin@website.com">When using JavaScript to modify web forms, it labels them in numbers with the first web form being [0] and so on. For the example, this form will be [0]. Let's hack this form so it submits the user's password to us.javascript:void(document.forms[0].to.value="hackeremail@gmail.com")This is basically saying "Void the documents first form, skip (to) and go to the value (value) and make it equal to my email".That's it, those are the basics of JavaScript injections! If you learn JavaScript from the ground up, which I hope you do, you can do some pretty awesome hacks with it. Take care, and come visit me and friends inIRC!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicensePhoto byhitthatswitchRelatedHow To:Write an XSS Cookie Stealer in JavaScript to Steal PasswordsHow To:Inject Coinhive Miners into Public Wi-Fi HotspotsHow To:Use Javascript to make websites more interactiveHow To:Hack websites with SQL injectionHow To:Hack Forum Accounts with Password-Stealing PicturesHow To:Beginner's Guide to OWASP Juice Shop, Your Practice Hacking Grounds for the 10 Most Common Web App VulnerabilitiesHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHow To:SQL Injection Finding Vulnerable Websites..SQL Injection 101:Database & SQL Basics Every Hacker Needs to KnowHIOB:WebSite Hacking Series Part 2: Hacking WebSites Using The DotNetNuke VulnerabilityBecome an Elite Hacker Part 4:Hacking a Website. [Part 1]How To:Use the jQuery Javascript framwork to make websitesHow To:Re-Enable Zoom for Websites That Block It in Safari for Your iPhoneHow To:Use the basics of the jQuery Javascript libraryHow To:Make an animated digital clock for your website using Javascript CSSHow To:Reveal Saved Browser Passwords with JavaScript InjectionsNews:Get YouTube's New Layout Today with a Simple JavaScript HackGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsForbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingHow To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)Goodnight Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker TrainingHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:JavaScript Codecademy TutorialHow To:How Hackers Steal Your Cash on Trusted Sites & How to Prevent Against ItNews:The Homepage of jQueryHow Null Byte Injections Work:A History of Our NamesakeNews:Fun Way to Learn JavaScript Basics!Goodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingHow To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseHow To:Access Wikipedia During Today's SOPA BlackoutGoodnight Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsHow To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitHow To:Noob's Introductory Guide to Hacking: Where to Get Started?News:DCPU PacmanGoogle Dorking:AmIDoinItRite?