I know this is very unlikely, but maybe there is another solution.
What I want to do is retrieve JavaScript generated data from an external website. This isn't for an exploit, but rather a test.
I noticed Google cannot index Ajax generated content.. but could they, and more importantly, how?
I guess that is a better way of putting it.
You certainly can do it on a case-by-case basis. However you wouldn't use a tool like cURL. Instead, you'd use something more sophisticated like a browser or javascript interpreter (Rhino springs to mind) to interpret and run the JS and then retrieve the values from there.
Related
This question already has answers here:
How do I hide javascript code in a webpage?
(12 answers)
Closed 9 years ago.
is it possible to hide codes written in java script (j query)?
i have written a program and i have used two much load() function .
every one can see my pages address is it a risk?
something Like this:
load('account/module/message/index.php');
load('account/module/ads/index.php');
load('account/module/stat/index.html');
No.
JavaScript is client side therefore all code written is, in some fashion, directly visible to the client (end user). You can obfuscate it and make it more difficult to decipher, but in the end is still accessible.
If security is of concern you can keep "business logic" within php and access it using JavaScript (e.g. Ajax calls) but the end points would still be visible.
On every site that uses Javascript, that javascript code is visible to the end user. Not only that, but the end user is able to debug it, and change the either the variable contents or even the code itself at any moment.
Despite this, millions of sites use Javascript, and many of those sites are considered secure. The point is that while JS code may be visible to the end user, it doesn't necessarily mean your system is insecure. You just have to write your system with the understanding of how it works.
Here are some pointers:
If you put secrets (eg passwords or business logic that must be kept private) into your JS code, then those secrets are not secure. Don't do this; keep those details on the server.
If your JS code does any kind of validation, then that validation could be bypassed, so your server-side code must also do the same validation.
If your JS code makes calls that run code on the server (eg your load(...) calls, then the server must verify that the user has permission to do so; don't rely on the JS code to do that check.
You can't "hide" the client-side code, the most you could hope to do is obfuscate it, which to me is largely pointless in the context of the web - code that is delivered to the client should be exposable without being dangerous - and you can hardly obfsucate URLs, anyway.
For parts that shouldn't be exposed, don't expose them. Do server-side generation and output only what is needed, what is "safe"; some trouble can come when mixing the two (say, wanting to hide away logic by doing it on the server, but still deliver it dynamically using AJAX), because your logic is indirectly exposed (that is, although it can't be seen, the results can be gathered, perhaps from a different domain to use your content, etc.)
You can try using an Obfuscation Tool like YUI Compressor http://yui.github.io/yuicompressor/
So your code will not be readable for end user... but hidding it it's impossible
Hidding values and stuff
If you want to keep your values private, so user can't read them obfuscation won't be really your choice, but of course your source will be minified, it will be a mess if you want to read it, but it's still there...
So your choice here is use some kind of encryption which will be decrypted when page loads, but it is a hard work, you can use base64, sha1 or whatever you want only the strings or values you want. But anyone can decrypt it if they really want to.
Definately not, because javascript executed client side so either if possible you do all the operation on server side scripting ( jsp/php/asp) or minify/compress your javascript code after moving it to a sepatate file.
Unfortunately not.
Javascript runs on the client machine in the web browser and cannot be hidden from someone looking at the source code.
However this does not pose a security risk for your application provided nothing internal is visible should you visit those pages in your browser.
process all your "secret" code on the server, where the user doesn't have access to the code. Send only "non secret" things to the client, like for the UI. If you can't avoid sending secret code to the client, obfuscate it to make it more difficult to read.
Put your Javascript code in external file.
And then minified your javscript code, may this helps you.
To Convert Normal Javascript into Minified Javascript Refer this http://jscompress.com/
I've got a webpage that makes several calls to external site APIs. Right now, I do this via PHP, and cache the responses to disk (using cachelite) where I can. Even so, the page seems to load very slowly, and I'm struggling to find a likely cause (the page speed tab in Chrome is not providing any useful clues).
So I wonder if there might be some benefit to having the client process the API calls via JQuery instead, so that at least the initial page load for the user is faster. Is it worth me doing this, or would I be better off trying to optimise the PHP code further?
It depends, if you want to have the result of the JSON indexed by Google, you need to parse it through PHP.
If you want the fastest way and less server load, use Javascript to load the JSON, the JSON will be loaded from an external source and cached by the users browser.
What is the load time of the JSON? Maybe the other server is slow?
PHP is server side scipting.
If you are not doing anything on server but just loading the contents from external Site APIs
I think it would be better if you use jQuery or javascript to the job for you.
I've been thinking about the two answers above and think maybe what I could do is combine both approaches, that is to say, have the json fetched and cached by a server-side php script, but have the user-facing PHP files use jquery to load data from the file.
I am looking for a way to let php act as a browser, does anyone know how to do that? I now how to get pages and how to send get/post forms, but How do i let php interact with AJAX and javascript on a web page?
Don't. PHP is not designed for this sort of thing. While conceivably possible, this'll take an extraordinary amount of work.
Use something designed for this sort of use case, like PhantomJS.
And please, don't be evil. Using this to get around valid anti-bot restrictions would be lame.
I want to write a PHP script that performs a routine task in a web app I use. I am trying to figure out the easiest way to submit a form, click a link, and get some information. What's the easiest way to do this (keeping the session open, etc.).
Javascript would be a better solution than PHP. You can use it in tandem with PHP to submit a form that references the same page, ie. <form method='index.php' action='post'>
If method is GET then you ought to be able to work it out form the URLs of a few real world attempts.
It POST then you are probably SOL unless it's your own web page./app and you know what $_POST it expects ... unless you find a tool to snoop your HTTP traffic and get the POST info from observing a few real wrold examples.
You can use CURL in PHP to simulate submitting data, clicked links, etc., I suppose, but a client-side scripting language like Javascript--as opposed to a server-side language like PHP--is more suited to what you're describing. I'd need more info to give you a specific example.
You will not be able directly emulate those events in PHP as web apps use Javascript on the client side and PHP is a different language and operates on the server side.
Firstly, I would see if there is an open API available for the web app you're wondering about, e.g. Gmail: http://code.google.com/apis/gmail/ . Not all APIs can do what the web app can do, so you'll need to check the documentation to make sure the API does what you want and has an easy way to interface with PHP.
The other option is to essentially reverse engineer how the web app communicates with it's server. Most all web apps operate by sending POST or GET HTTP data in some sort of serialized format like XML, JSON or text. You can use something like the Firebug add-on for Firefox to view POST/GET data. If you know what the server sends to the client and what the client sends to the server, you can essentially write a script using something like CURL to emulate the client in PHP instead of JavaScript. This would take quite a bit of work and probably involves a lot of trail & error.
Is it possible for a web page using Javascript to get data from another website? In my case I want to get it for calculations and graphing a chart. But I'm not sure if this is possible or not due to security concerns. If it is considered a no no but there is a work around I would appreciate being told the work around. I don't want to have to gather this information on the server side if possible.
Any and all help is appreciated.
Learn about JSONP format and cross-site requests (http://en.wikipedia.org/wiki/JSON#JSONP).
You may need to use the "PHP-proxy" script at your server side which will get the information from the websites and provide it to yours Javascript.
The only reliable way is to let "your" webserver act as a proxy. In PHP you can use curl() to fire a HTTP request to an external site and then just echo the response.
You can't pull data from another server due to the same origin policy. You can do some tricks to get around it, such as putting the URL in a <script> tag, but in your case it wouldn't work for just parsing HTML.
Use simple_dom_html, to parse your data server side. it is much easier than doing it in JavaScript anyways.
A simple way you might be able to do this is to use an inline iframe. If the web page you are getting the data from has no headers, or you can isolate the data being pulled in (to say an image or SWF), this might work.
cross-domain javascript used to be impossible, using a (php-)proxy was a workaround for that.
jsonp changes this entirely, it allows to request javascript from another server (if it has an API that supports jsonp, a lot of the bigger webplayers like google, twitter, yahoo, ... do), specifying the callback-function in your code that needs to be triggered to act on the response.
the response in javascript will contain:
a call to a callback-function you defined
the actual payload as a javascript-object.
frameworks like jquery offer easy support for jsonp out of the box.
once you have the raw data you could tie into google chart tools to create graphs on the fly and insert them in your webapp.
Also worth considering is support for XMLHttpRequest Access Control which is support in some modern browsers.
If the service provider that you are trying to access via a web page has this set up, it is a very simple call to XMLHttpRequest and you will get access to the resources on that site without the need for JSONP (especially useful for requests that are not GET, i.e. POST, HEAD etc)