API 05: Minified JavaScript Analysis

Description: In this video, we explore the challenge API_05 from the API badge on PentesterLab. We demonstrate how to analyze minified JavaScript code to find hidden API endpoints.

1. Context & Situation#

Target: API 05 (Hidden Endpoint)

Initial Problem: This challenge is similar to API_04, but with a twist: the JavaScript file is minified (all code is on one line, making it very hard to read).

2. The Discovery#

Step 1: Finding the Minified JavaScript#

I visited the website and checked the JavaScript files. I found that all the code was compressed into a single line - impossible to read!

Problem: The code looks like this:

angular.module('Approval').factory('request',['$http',function($http){var o={requests:[]};o.create=function(item){o.requests.push(item)};o.get_more_secret=function(){return $http.post('/get_more_secret',angular.toJson({"name":"CTF_KEY"})).then(function(res){})};return o}]);

Everything is squeezed together with no spaces or line breaks!

Step 2: Using a JavaScript Beautifier#

Since the code was unreadable, I used an online tool to format it properly.

Tool Used: https://beautifier.io/ (opens in a new tab)

I copied the minified code and pasted it into the beautifier.

Result: The code became readable:

angular.module('Approval')
.factory('request', ['$http', function($http){
  var o = {
    requests: [],
  };
  
  o.create = function(item) {
    o.requests.push(item);
  };
  
  o.get_more_secret = function() {
    return $http.post('/get_more_secret', angular.toJson({"name":"CTF_KEY"})).then(function(res){
    });
  };
  
  return o;
}]);

Key Finding: There's a hidden endpoint /get_more_secret that uses POST method!

Step 3: Testing the Endpoint#

I sent a POST request to the endpoint:

• Command:

  bashCopy

  curl -X POST https://ptl-b396489f2a34-bae0754d0f2a.libcurl.me/get_more_secret

• Result: Success!
• Response:

  jsonCopy

  {"CTF_KEY":"flag{API5_is_DOne}"}

3. The Vulnerability#

Type: Security Through Obscurity + Minified Code Analysis

Impact: Developers think that minifying JavaScript makes it "secure" or hard to reverse engineer. But tools like beautifiers make it easy to read the code again and find hidden endpoints.

4. What We Learned#

The Issue:

• Minified JavaScript is NOT secure
• It only makes code smaller for faster loading
• Anyone can use a beautifier to make it readable again
• Hidden endpoints in client-side code can always be found

Why Minification is NOT Security:

• Minification is for performance, not security
• Tools can easily reverse the minification
• The logic and endpoints are still visible
• Client-side code is always accessible to attackers

5. Attack Summary#

1. Find the minified JavaScript file
2. Copy the minified code
3. Beautify it using https://beautifier.io/ (opens in a new tab)
4. Read the code to find hidden endpoints
5. Test the endpoint with the correct HTTP method
6. Get the flag!

6. How to Fix This#

Proper Security:

1. Never rely on minification for security
2. Don't put sensitive endpoints in client-side JavaScript
3. Use server-side authentication and authorization
4. Implement proper access control on all endpoints
5. Use API keys or tokens to protect sensitive data
6. Assume attackers can read all client-side code

Better Approach:

• Keep sensitive logic on the server
• Use proper authentication (JWT, OAuth, etc.)
• Validate permissions on every request
• Don't trust anything from the client

Lab Completed!