JavaScript Shell

JavaScript Shell is a simple application designed to automate the testing process of certain tools that has been developed lately. There are several problems with this implementation. The first one is related to managing the varable scope. There is also a small bug in the history implementation. These problems were successfully fixed in AttackAPI.

You can download the code from here.

JavaScript shell mimics the ipython shell a bit, therefore the following builtins are supported: dir, print, load, clear and hist.

Comments

afos responds:

hi,

there is a nice bookmarklet around, which implements some goodies: http://www.squarefree.com/shell/

pdp responds:

Yeh, I’ve seen that one. Actually I had very good go through the source code of this implementation. It is good, however I just don’t like the way the console is implemented. Moreover, there is no clear separation between the console and the shell. This makes it not suitable for my projects.

Pat responds:

Hmm, this would be a great way to add quick JavaScript style shell functionality to those with hosting accounts FOR use by hosting companies so they can have SSH over HTTPS :P

But ofcourse, you’d have to make a few modifications and DEFINITELY need to use HTTPS with session management, but damn… that’d work, I think. What do you think? Email me if/when you respond. I’m overloaded with links from your site today. Thanks.

pdp responds:

Pat, you are right. The shell is quite flexible. As you can see this project is composed of a console that can handle all kinds of shells. The JavaScript shell is only one implementation. You can add a different command shell or remote shell into the console.

For pure pen-testing purposes the console can be used to hook into a SQL Injection vulnerability. In this case you can build a pure MYSQL interactive shell. I’ve done it on a few occasions and I must say this is quite neat and handy.

BTW, the version provided here is a bit outdated. Please check AttackAPI and more precisely MasterAPI.js for the latest version.

pdp responds:

This tool is no longer part of AttackAPI. I guess that we need to fork it into a new project.

ryan responds:

this looks great! i can’t find a download link, though. the MasterAPI.js link is broken. i’ve searched this site and the google code project, but i can’t find the shell. is it still available?

pdp responds:

Hi ryan, I am not longer working on this tool, however, you can still get the source code from AttackAPI subversion repository, although, you need to go several commits back.

GNUCITIZEN

Navigation

Comments

Respond

The Others

External Projects

Recent Posts

Random Posts

From The Cutting-edge Network