Javascript has been extensively used for several years ever since it was first developed by Netscape in 1995. It has virtually revolutionized the way the Internet and websites work by adding functionality that is lightweight yet feature-filled. Ad servers use javascript to display ads on websites, ads are virtually bread and butter to the website publisher and is thus responsible to several successful, established and useful websites. Apart from ads Javascript is also used to add graphical effects as well as several other functions to websites.
However, Javascript has been responsible for several security vulnerabilities over the years.
Securing client-side JavaScript is a problem that has started receiving attention. Third-party JavaScript issues from widgets, embedded code and JavaScript libraries are some of the vulnerable aspects of JavaScript that see active exploitation.
JavaScript security issues can be divided into three broad categories:
1. DOM-based cross-site scripting (XSS) :
XSS is usually the result of insecurely written server-side code, DOM-based XSS is a kind of XSS occurring entirely on the client-side.
2. Cross-domain information leakage : JavaScript has cross-domain functionality that allows sites to load multiple objects from various sources (widgets or iframes, among others). Until recently, JavaScript had restrictions on accessing/sending data to other domains. However, HTML5 has increased the level of cross-domain access that JavaScript enjoys with the cross-domain XML request function.
3. Client-side logic and data storage : Initially, JavaScript performance and capabilities were very limited, receiving no significant focus from browser developers for improving performance. As JavaScript engines get faster with iterations of browser release, it is possible to perform substantial processing on the client-side.With HTML5, client-side storage mechanisms have gone beyond the cookie with newer options such as localStorage, Web SQL and IndexDB. Storage of sensitive data on the client side using these mechanisms fosters a huge security risk, bigger than cookies ever posed.
There are plenty of open source tools available SecureJs is one of them, let's see step by step how to scan your JavaScript libraries with SecureJs.
Step 1: Installing NodeJs : Download the Node.js source code from http://nodejs.org/download/ and install it in your system.
Step 2: Installing npm : npm (Node Package Manager) is the default package manager for Node.js. As of Node.js version 0.6.3, npm is bundled and installed automatically with the environment. npm runs through the command line and manages dependencies for an application. for Windows You can download a zip file from https://npmjs.org/dist/, and unpack it in the same folder where node.exe lives( Inside Program Files folder ).
Atep 3: Open Command Prompt and Install Retire JS using command "npm install -g retire" your Command Promt display will be like this :
C:\Users\satyendra.jaiswal\AppData\Roaming\npm\retire -> C:\Users\satyendra.jaiswal\AppData\Roaming\npm\node_modules\retire\b
in\retire
retire@0.3.1 C:\Users\satyendra.jaiswal\AppData\Roaming\npm\node_modules\retire
├── commander@2.0.0
├── underscore@1.4.4
├── walkdir@0.0.7
├── request@2.40.0 (forever-agent@0.5.2, oauth-sign@0.3.0, json-stringify-safe@5.0.0, aws-sign2@0.5.0, stringstream@0.0.4, tu
nnel-agent@0.4.0, qs@1.0.2, node-uuid@1.4.1, mime-types@1.0.2, http-signature@0.10.0, hawk@1.1.1, tough-cookie@0.12.1, form-d
ata@0.1.4)
└── read-installed@0.2.5 (graceful-fs@2.0.3, slide@1.1.6, semver@2.3.2, read-package-json@1.2.7)
Step 3 : Test if Retire is installed using retire command like : retire -h
Step 4 : Scan JS files of a specific folder using retire command : use retire -c to avoide local cache
If you are behind the proxy then use these steps :
Step 1: Set Proxy on command prompt :
npm config set registry http://registry.npmjs.org/
npm config set proxy http://myusername:mypassword@proxyIPorAddress:8080
npm config set https-proxy http://myusername:mypassword@proxyIPorAddress:8080
npm config set strict-ssl false
set HTTPS_PROXY=http://myusername:mypassword@proxyIPorAddress:8080
set HTTP_PROXY=http://myusername:mypassword@proxyIPorAddress:8080
export HTTPS_PROXY=http://myusername:mypassword@proxyIPorAddress:8080
export HTTP_PROXY=http://myusername:mypassword@proxyIPorAddress:8080
export http_proxy=http://myusername:mypassword@proxyIPorAddress:8080
Step 2: Install Retire :
npm --proxy http://myusername:mypassword@proxyIPorAddress:8080 --without-ssl --insecure -g install retire
Step 3 : Test if Retire is installed using retire command like : retire -h
Step 4 : Scan JS files of a specific folder using retire command
However, Javascript has been responsible for several security vulnerabilities over the years.
Securing client-side JavaScript is a problem that has started receiving attention. Third-party JavaScript issues from widgets, embedded code and JavaScript libraries are some of the vulnerable aspects of JavaScript that see active exploitation.
JavaScript security issues can be divided into three broad categories:
1. DOM-based cross-site scripting (XSS) :
XSS is usually the result of insecurely written server-side code, DOM-based XSS is a kind of XSS occurring entirely on the client-side.
2. Cross-domain information leakage : JavaScript has cross-domain functionality that allows sites to load multiple objects from various sources (widgets or iframes, among others). Until recently, JavaScript had restrictions on accessing/sending data to other domains. However, HTML5 has increased the level of cross-domain access that JavaScript enjoys with the cross-domain XML request function.
3. Client-side logic and data storage : Initially, JavaScript performance and capabilities were very limited, receiving no significant focus from browser developers for improving performance. As JavaScript engines get faster with iterations of browser release, it is possible to perform substantial processing on the client-side.With HTML5, client-side storage mechanisms have gone beyond the cookie with newer options such as localStorage, Web SQL and IndexDB. Storage of sensitive data on the client side using these mechanisms fosters a huge security risk, bigger than cookies ever posed.
There are plenty of open source tools available SecureJs is one of them, let's see step by step how to scan your JavaScript libraries with SecureJs.
Step 1: Installing NodeJs : Download the Node.js source code from http://nodejs.org/download/ and install it in your system.
Step 2: Installing npm : npm (Node Package Manager) is the default package manager for Node.js. As of Node.js version 0.6.3, npm is bundled and installed automatically with the environment. npm runs through the command line and manages dependencies for an application. for Windows You can download a zip file from https://npmjs.org/dist/, and unpack it in the same folder where node.exe lives( Inside Program Files folder ).
Atep 3: Open Command Prompt and Install Retire JS using command "npm install -g retire" your Command Promt display will be like this :
C:\Users\satyendra.jaiswal\AppData\Roaming\npm\retire -> C:\Users\satyendra.jaiswal\AppData\Roaming\npm\node_modules\retire\b
in\retire
retire@0.3.1 C:\Users\satyendra.jaiswal\AppData\Roaming\npm\node_modules\retire
├── commander@2.0.0
├── underscore@1.4.4
├── walkdir@0.0.7
├── request@2.40.0 (forever-agent@0.5.2, oauth-sign@0.3.0, json-stringify-safe@5.0.0, aws-sign2@0.5.0, stringstream@0.0.4, tu
nnel-agent@0.4.0, qs@1.0.2, node-uuid@1.4.1, mime-types@1.0.2, http-signature@0.10.0, hawk@1.1.1, tough-cookie@0.12.1, form-d
ata@0.1.4)
└── read-installed@0.2.5 (graceful-fs@2.0.3, slide@1.1.6, semver@2.3.2, read-package-json@1.2.7)
Step 3 : Test if Retire is installed using retire command like : retire -h
Step 4 : Scan JS files of a specific folder using retire command : use retire -c to avoide local cache
If you are behind the proxy then use these steps :
Step 1: Set Proxy on command prompt :
npm config set registry http://registry.npmjs.org/
npm config set proxy http://myusername:mypassword@proxyIPorAddress:8080
npm config set https-proxy http://myusername:mypassword@proxyIPorAddress:8080
npm config set strict-ssl false
set HTTPS_PROXY=http://myusername:mypassword@proxyIPorAddress:8080
set HTTP_PROXY=http://myusername:mypassword@proxyIPorAddress:8080
export HTTPS_PROXY=http://myusername:mypassword@proxyIPorAddress:8080
export HTTP_PROXY=http://myusername:mypassword@proxyIPorAddress:8080
export http_proxy=http://myusername:mypassword@proxyIPorAddress:8080
Step 2: Install Retire :
npm --proxy http://myusername:mypassword@proxyIPorAddress:8080 --without-ssl --insecure -g install retire
Step 3 : Test if Retire is installed using retire command like : retire -h
Step 4 : Scan JS files of a specific folder using retire command
No comments:
Post a Comment