Skip to main content
1 min read Intermediate Source Code

InsecurFun

1. XSS​

Get-ChildItem -Recurse | Select-String "dangerouslySetInnerHTML|innerHTML|outerHTML|document.write|insertAdjacentHTML|DOMParser|eval\(|new Function"

2. SQL Injection (backend code in same repo)​

Get-ChildItem -Recurse | Select-String "SELECT |INSERT |UPDATE |DELETE |query\(|execute\(|sequelize.query|knex.raw|raw\("

3. Command Injection​

Get-ChildItem -Recurse | Select-String "exec\(|execSync|spawn\(|spawnSync|fork\(|child_process"

4. SSRF​

Get-ChildItem -Recurse | Select-String "axios.get|axios.post|fetch\(|request\(|http.get|https.get|new URL"

5. Open Redirect​

Get-ChildItem -Recurse | Select-String "window.location|location.href|redirect|navigate\(|history.push|router.push"

6. JWT / Authentication​

Get-ChildItem -Recurse | Select-String "jwt|jsonwebtoken|Bearer|accessToken|refreshToken|idToken|Authorization"

7. Secrets / API Keys​

Get-ChildItem -Recurse | Select-String "password|secret|clientSecret|apiKey|privateKey|token"

8. Debug Logging​

Get-ChildItem -Recurse | Select-String "console.log|console.debug|logger.debug|debug\("

9. Security Headers​

Get-ChildItem -Recurse | Select-String "helmet|Content-Security-Policy|Strict-Transport-Security|X-Frame-Options|X-Content-Type-Options|Referrer-Policy|Permissions-Policy"

10. CORS​

Get-ChildItem -Recurse | Select-String "Access-Control-Allow-Origin|cors\(|origin:"
Get-ChildItem -Recurse | Select-String "HttpOnly|Secure|SameSite|cookie"

12. File Upload​

Get-ChildItem -Recurse | Select-String "multipart|FormData|multer|upload|file"

13. Path Traversal​

Get-ChildItem -Recurse | Select-String "readFile|writeFile|createReadStream|createWriteStream|path.join|path.resolve"

14. CSRF​

Get-ChildItem -Recurse | Select-String "csrf|xsrf|X-CSRF|X-XSRF"

15. Hardcoded URLs / Localhost​

Get-ChildItem -Recurse | Select-String "localhost|127.0.0.1|http://|https://"

1. Find Potential Directory Listing Candidates​

One-liner 1 – Common public directories

Get-ChildItem -Recurse -Directory | Where-Object {$_.Name -match '^(public|static|assets|uploads?|images|img|media|downloads?|files|docs|resources)$'} | Select-Object FullName

One-liner 2 – Directories containing web files

Get-ChildItem -Recurse -File | Where-Object {$_.Extension -match '^\.(html?|js|css|json|xml|png|jpe?g|gif|svg|pdf)$'} | Group-Object DirectoryName | Sort-Object Count -Descending | Select-Object Count,Name

2. Find Potentially Unauthenticated Pages​

One-liner 1 – Find React route definitions

Get-ChildItem -Recurse -File -Include *.js,*.jsx,*.ts,*.tsx | Select-String -Pattern '<Route|createBrowserRouter|useRoutes|path:'

One-liner 2 – Find page components

Get-ChildItem -Recurse -File -Include *.js,*.jsx,*.ts,*.tsx | Select-String -Pattern 'export default|function .*Page|const .*Page|lazy\('

Faster approach​

Get-ChildItem -Recurse |
Select-String "dangerouslySetInnerHTML|eval\(|innerHTML|outerHTML|document.write|exec\(|spawn\(|query\(|SELECT |INSERT |UPDATE |DELETE |accessToken|refreshToken|jwt|Bearer|password|secret|clientSecret|apiKey|console.log|logger.debug|helmet|Content-Security-Policy|X-Frame-Options|cors\(|HttpOnly|SameSite|Secure|csrf|fetch\(|axios|window.location|redirect|navigate\("