Ethical Hacker Tip: Query All Fields – Display Nice List

As seen in the image below, this one-liner in JavaScript (to be pasted into dev tools/inspect) on your target (once the page is loaded) will reveal all `` fields. Remember: input can be “hidden,” meaning you won’t see any input bar, but the default is to show an input bar. This method will show (all) input statements.

Paste into console:

console.table([...document.querySelectorAll('input')].map(e => ({ id: e.id, name: e.name, value: e.value })));

Once you hit enter, provided the page you have loaded currently (this should work in any browser that has dev tools), you should see what is displayed in the screenshot. Examine them closely, as this can reveal information that can be an excellent way of finding new attack surfaces and obviously hidden input fields that may be hidden for a reason.

You Should Know:

1. Linux Command to Extract Hidden Inputs from Web Pages:

– Use `curl` and `grep` to extract hidden input fields from a webpage:

curl -s http://example.com | grep -oP '<input type="text">]<em>type="hidden"[^>]</em>>'

– This command fetches the webpage and filters out hidden input fields.

2. Windows PowerShell Command to Analyze Web Forms:

• Use PowerShell to inspect web forms:

  Invoke-WebRequest -Uri "http://example.com" | Select-String -Pattern '<input type="text">]<em>type="hidden"[^>]</em>>'
  

• This command retrieves the webpage content and searches for hidden input fields.

3. Python Script to Automate Input Field Extraction:

• Use Python with BeautifulSoup to extract input fields:

  import requests
  from bs4 import BeautifulSoup</li>
  </ul>
  
  url = "http://example.com"
  response = requests.get(url)
  soup = BeautifulSoup(response.text, 'html.parser')
  
  for input_tag in soup.find_all('input'):
  print(input_tag)
  

  – This script fetches the webpage and prints all input tags.

  4. Bash Script to Monitor Webpage Changes:

  • Use a bash script to monitor changes in input fields:

    #!/bin/bash
    while true; do
    curl -s http://example.com | grep -oP '<input type="text">]*>' > current_inputs.txt
    if ! diff -q previous_inputs.txt current_inputs.txt > /dev/null; then
    echo "Input fields changed!"
    diff previous_inputs.txt current_inputs.txt
    cp current_inputs.txt previous_inputs.txt
    fi
    sleep 60
    done
    

  • This script checks for changes in input fields every 60 seconds.
  1. Linux Command to Test for Vulnerable Input Fields:

  – Use `nikto` to scan for vulnerable input fields:

  nikto -h http://example.com -C all
  

  – This command scans the target website for vulnerabilities, including insecure input fields.

  What Undercode Say:

  Understanding and manipulating input fields is crucial for both ethical hackers and malicious attackers. By using the provided JavaScript snippet, Linux commands, PowerShell scripts, and Python scripts, you can uncover hidden input fields and analyze them for potential vulnerabilities. Always ensure you have permission before testing on any website, and use these techniques responsibly to improve security.

  For further reading on web security and ethical hacking, visit:
  – OWASP Web Security Testing Guide
  – PortSwigger Web Security Academy
  – Kali Linux Documentation

  References:

  Reported By: Activity 7305408648019673088 – Hackers Feeds
  Extra Hub: Undercode MoN
  Basic Verification: Pass ✅

  Join Our Cyber World:

  💬 Whatsapp | 💬 Telegram