02. Tooling

The best hacking tool is already installed: your browser. Everything else is a bonus.

Browser DevTools

Open with F12, Ctrl+Shift+I (Windows/Linux) or Cmd+Option+I (Mac).

Tab	Use it to
Elements	Inspect and edit the live HTML. Find hidden fields and comments.
Console	Run JavaScript on the page. Read `document.cookie`.
Sources	Read every JavaScript file the site loads. Developers leave secrets here.
Network	Watch every request and response. Find hidden API endpoints.
Application	View and edit cookies and localStorage.

Quick wins

// View page source (raw HTML, including comments)
Ctrl+U  /  Cmd+Option+U

// In the Console
document.cookie                     // read cookies
document.cookie = "role=admin"      // set a cookie
atob("aGVsbG8=")                    // decode base64
btoa("hello")                       // encode base64

Burp Suite

Burp is an intercepting proxy. It sits between your browser and the server, letting you pause, read and change every request before it's sent.

Browser  ───►  Burp Suite  ───►  Server
               (you edit
                requests here)

Setup (Community Edition, free)

Download from portswigger.net
Start a temporary project with defaults
Go to Proxy → Intercept → Open browser. Burp's built-in Chromium is already configured.
Browse to a site and watch requests appear in Proxy → HTTP history

The features you'll use most

Feature	What it does
Proxy / Intercept	Pause a request, edit it, forward it
HTTP history	Log of everything your browser sent
Repeater	Resend one request over and over with tweaks. Your main workbench.
Decoder	Encode and decode base64, URL, HTML...

For today Every lab in this workshop runs inside your browser, so DevTools alone is enough to solve all of them. Burp is the tool you'll want for real targets, so set it up afterwards.

Encoding Cheat Sheet

Type	Example	Looks like
URL encoding	`' OR 1=1`	`%27%20OR%201%3D1`
Base64	`{"role":"user"}`	`eyJyb2xlIjoidXNlciJ9`
HTML entities	`<script>`	`<script>`

Base64 tip: anything starting with eyJ is base64-encoded JSON ({").

03-recon →