===== Bookmarklets útiles para auditorías de seguridad / pentesting =====

Recopilación de Bookmarklets que pueden ser de utilidad en el campo de la seguridad informática. Se recomienda crear marcadores en el navegador con la recopilación de los Bookmarklets que interesen, de esa forma están siempre disponibles.

**Elimina la limitación maxlength de formularios.**
<code javascript>javascript:for%20(i=0;i<document.forms.length;++i)%20{for(j=0;j<document.forms[i].elements.length;++j){document.forms[i].elements[j].removeAttribute(%22maxLength%22);}}</code>

**Muestra todos los links en una ventana emergente.**
<code javascript>javascript:WN7z=open('','Z6','width=600,height=200,scrollbars,resizable,menubar');DL5e=document.links;with(WN7z.document){write('<base%20target=_blank>');for(lKi=0;lKi<DL5e.length;lKi++){write(DL5e[lKi].toString().link(DL5e[lKi])+'<br><br>')};void(close())}</code>

**Visualiza inputs ocultos.**
<code javascript>javascript:for%20(i=0;i<document.forms.length;++i)%20{for(j=0;j<document.forms[i].elements.length;++j){document.forms[i].elements[j].removeAttribute(%22maxLength%22);}}</code>

**Lista los scripts y su código fuente incorporados en la web visitada.**
<code javascript>javascript:s=document.getElementsByTagName('SCRIPT');%20d=window.open().document;%20/*140681*/d.open();d.close();%20b=d.body;%20function%20trim(s){return%20s.replace(/^\s*\n/,%20'').replace(/\s*$/,%20'');%20};%20function%20add(h){b.appendChild(h);}%20function%20makeTag(t){return%20d.createElement(t);}%20function%20makeText(tag,text){t=makeTag(tag);t.appendChild(d.createTextNode(text));%20return%20t;}%20add(makeText('style',%20'iframe{width:100%;height:18em;border:1px%20solid;'));%20add(makeText('h3',%20d.title='Scripts%20in%20'%20+%20location.href));%20for(i=0;%20i<s.length;%20++i)%20{%20if%20(s[i].src)%20{%20add(makeText('h4','script%20src="'%20+%20s[i].src%20+%20'"'));%20iframe=makeTag('iframe');%20iframe.src=s[i].src;%20add(iframe);%20}%20else%20{%20add(makeText('h4','Inline%20script'));%20add(makeText('pre',%20trim(s[i].innerHTML)));%20}%20}%20void%200</code>

**Visualiza la variables y funciones JavaScript utilizadas.**
<code javascript>javascript:(function(){var%20a={},b=[],i,e,c,k,d,s="<table%20border=1><thead><tr><th>#</th><th>Tag</th><th>className</th></tr></thead>";for(i=0;e=document.getElementsByTagName("*")[i];++i)if(c=e.className){k=e.tagName+"."+c;a[k]=a[k]?a[k]+1:1;}for(k%20in%20a)b.push([k,a[k]]);b.sort();for(i%20in%20b)%20s+="<tr><td>"+b[i][1]+"</td><td>"+b[i][0].split(".").join("</td><td>")+"</td></tr>";s+="</table>";d=open().document;d.write(s);d.close();})()</code>

**Muestra las Contraseñas detrás de los asteriscos**.
<code javascript>javascript:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j<F.length; ++j) { f = F[j]; for (i=0; i<f.length; ++i) { if (f[i].type.toLowerCase() == "password") s += f[i].value + "\n"; } } if (s) alert("Pass:\n\n" + s); else alert("No Pass");})();</code>

**Busca la página web en el cache de Google**
<code javascript>javascript: (function(){%20document.location.href='http://www.google.com/search?q=cache:'+escape(document.location.href)%20})();</code>

**Muestra un texbox para buscar con google contenido / ficheros en la web visitada**.
<code javascript>javascript: (function(){%20p=prompt('Search%20term:','');%20if(p){%20document.location.href='http://www.google.com/search?q=site:'+document.location.href.split('/')[2]+'%20'+escape(p)}%20})();</code>

**Muestra un texbox para buscar con google ficheros en la web visitada** (.sql, .asa, .inc, .zip, .tar, .gz, .tgz, .rar, .7z, .java, .txt, .bak, .old).
<code javascript>javascript:%20(function(){%20document.location.href='http://www.google.com/search?q=site:'+document.location.href.split('/')[2]+'%20ext:sql%20OR%20ext:asa%20OR%20ext:inc%20OR%20ext:zip%20OR%20ext:tar%20OR%20ext:gz%20OR%20ext:tgz%20OR%20ext:rar%20OR%20ext:7z%20OR%20ext:java%20OR%20ext:txt%20OR%20ext:bak%20OR%20ext:old'%20})();</code>

**Muestra las Cookies.**
<code javascript>javascript:alert(document.cookie);</code>

**Editar Cookies.**
<code javascript>javascript:document.cookie=prompt(document.cookie,document.cookie)+%22;path=/;%22;</code>

**Editar la página Web.**
<code javascript>javascript: document.body.contentEditable='true'; document.designMode='on'; void 0</code>

**Cambia el sombreado de los elementos** (Útil para encontrar posibles tablas, iframes o textos ocultos).
<code javascript>javascript:(function(){var%20s="body",c="",I="%20!%20important;",i,b,f,x,h;%20for(i=0;i<17;++i)%20{%20x%20=%20i.toString(16);%20b%20=%20i>15?"FCC":x+x+x;%20f%20=%20i>9?"000":"FFF";%20c%20+=%20s%20+%20"%20{background:%20#"%20+%20b%20+%20I%20+%20"border-color:%20#"%20+%20b%20+%20I%20+%20"color:%20#"%20+%20f%20+%20I%20+%20"}\n";%20s%20+=%20"%20*";%20}%20if(document.createStyleSheet)%20{%20document.createStyleSheet("javascript:'"+c+"'");%20}%20else%20{%20h=document.createElement('link');%20h.rel='stylesheet';%20h.href='data:text/css,'+escape(c);%20document.getElementsByTagName("head")[0].appendChild(h);}})()</code>


**Visualiza todas las imágenes de la página.**
<code javascript>javascript:pagina='';for(indice=0;indice<document.images.length;indice++){ pagina+='<img src='+document.images[indice].src+'><br>'}; if(pagina!=''){document.write('<center>'+pagina+'</center>'); void(document.close())}else{alert('No images!')}</code>