JS Analysis (Endpoint & Secret Mining)

90% of API endpoints aren't in the navbar — they're in main.bundle.js.

When to invoke

Trigger phrases:

• "analyze JS"
• "find endpoints in JS"
• "mine secrets from javascript"
• "extract API from bundle"

Why JS analysis pays

Modern SPAs (React/Vue/Angular) load all their API routes in JavaScript. The UI shows you maybe 10% of the routes — the bundle has 100% of them, including:

• Admin / debug endpoints
• Internal API versions (v1 alongside v2)
• Webhook handlers
• File upload endpoints
• Search backends
• Hardcoded API keys (S3, Stripe, Mapbox, Twilio)
• AWS access keys (still happens in 2026)
• Internal hostnames / IPs
• GraphQL queries with field hints

Step-by-Step Workflow

1. Get all JS file URLs

TARGET="app.target.com"
OUT="loot/$TARGET/js"
mkdir -p "$OUT"

# Method A: katana crawl with JS extraction
katana -u "https://$TARGET" -d 3 -jc -kf all -silent | \
    grep -E '\.js(\?|$)' | sort -u > "$OUT/js-urls.txt"

# Method B: waybackurls / gau for historical JS
echo "$TARGET" | gau --providers wayback,otx | grep -E '\.js(\?|$)' | sort -u >> "$OUT/js-urls.txt"

# Method C: from httpx-grabbed JS
cat live.txt | httpx -silent -extract-regex 'src="([^"]+\.js[^"]*)"' -no-color | sort -u >> "$OUT/js-urls.txt"

# Dedupe
sort -u "$OUT/js-urls.txt" -o "$OUT/js-urls.txt"
echo "[+] $(wc -l < "$OUT/js-urls.txt") JS files found"

2. Download JS files locally

# Parallel download
mkdir -p "$OUT/files"
cat "$OUT/js-urls.txt" | xargs -P 10 -I{} sh -c 'curl -s -L -o "$1/files/$(echo "$2" | md5sum | cut -d" " -f1).js" "$2"' _ "$OUT" {}

# Or with getJS tool
go install github.com/003random/getJS@latest
getJS --url "https://$TARGET" --complete --output "$OUT/files/"

3. Extract endpoints (LinkFinder)

# LinkFinder — the standard for endpoint extraction
cd ~/tools/LinkFinder
pip install -r requirements.txt  # one-time

# Process each JS file
while read js; do
    python3 linkfinder.py -i "$js" -o cli
done < "$OUT/js-urls.txt" | sort -u > "$OUT/endpoints-raw.txt"

# Or in one shot with a remote URL list
python3 linkfinder.py -i "https://$TARGET" -d -o cli > "$OUT/endpoints-raw.txt"

4. Filter & normalize endpoints

# Remove junk (data:, font references, etc.)
cat "$OUT/endpoints-raw.txt" | \
    grep -vE '\.(png|jpg|gif|svg|woff|ttf|css|map)$' | \
    grep -E '^/?[a-zA-Z0-9_/.-]+' | \
    sort -u > "$OUT/endpoints.txt"

# Convert relative → absolute
awk -v target="https://$TARGET" '
    /^\/(api|v[0-9]|graphql|admin|user)/ { print target $0; next }
    /^https?:/ { print; next }
    { print target "/" $0 }
' "$OUT/endpoints.txt" | sort -u > "$OUT/endpoints-absolute.txt"

5. Mine secrets (SecretFinder + trufflehog)

# SecretFinder
cd ~/tools/SecretFinder
while read js; do
    python3 SecretFinder.py -i "$js" -o cli
done < "$OUT/js-urls.txt" | tee "$OUT/secrets-raw.txt"

# trufflehog (more comprehensive)
trufflehog filesystem "$OUT/files/" --json | tee "$OUT/trufflehog.jsonl"

# noseyparker (modern, very thorough)
noseyparker scan --datastore /tmp/np-store "$OUT/files/"
noseyparker report --datastore /tmp/np-store > "$OUT/noseyparker.txt"

6. JSluice — modern, fast, accurate

# Install
go install github.com/BishopFox/jsluice/cmd/jsluice@latest

# Per-file analysis
while read js; do
    curl -s "$js" | jsluice urls -
    curl -s "$js" | jsluice secrets -
done < "$OUT/js-urls.txt" > "$OUT/jsluice-output.txt"

# Or full crawl
cat "$OUT/js-urls.txt" | jsluice urls --source - --json > "$OUT/jsluice-urls.jsonl"
cat "$OUT/js-urls.txt" | jsluice secrets --source - --json > "$OUT/jsluice-secrets.jsonl"

7. Hunt source maps (jackpot if exposed)

# Check for .map files
cat "$OUT/js-urls.txt" | sed 's/$/.map/' | httpx -silent -mc 200 -o "$OUT/sourcemaps-exposed.txt"

# If found — extract original source
# sourcemapper (Go tool)
go install github.com/denandz/sourcemapper@latest
while read map; do
    sourcemapper -url "$map" -output "$OUT/source/$(basename "$map" .map)"
done < "$OUT/sourcemaps-exposed.txt"

# Original source = full file paths, comments, dev hints — gold

8. Find hardcoded credentials (focused patterns)

Custom regex set for common BB patterns:

cat "$OUT/files/"*.js | grep -aoE '(AKIA[0-9A-Z]{16}|sk_live_[0-9a-zA-Z]{24,}|xox[bpoars]-[0-9]{12}-[0-9]{12}-[a-zA-Z0-9]{24}|ghp_[A-Za-z0-9]{36}|gho_[A-Za-z0-9]{36}|AIza[0-9A-Za-z\-_]{35})' | sort -u
# Patterns:
# AKIA…           → AWS Access Key
# sk_live_…       → Stripe Live Secret
# xox[bpoars]-…   → Slack token
# ghp_…           → GitHub PAT
# AIza…           → Google API Key

For a richer regex set, use gitleaks with extended config on JS files:

gitleaks dir --source "$OUT/files/" --config ~/tools/gitleaks-config.toml -r "$OUT/gitleaks-report.json"

9. Mine GraphQL queries embedded in JS

# GraphQL operations are often hardcoded — full field/argument names!
grep -hE 'query [A-Za-z]+|mutation [A-Za-z]+' "$OUT/files/"*.js | sort -u > "$OUT/graphql-operations.txt"

# Look for field structures
grep -hoE '{ [a-zA-Z_]+ [a-zA-Z_]+' "$OUT/files/"*.js | head -20

10. Endpoint validation (which are live?)

# Probe each found endpoint
cat "$OUT/endpoints-absolute.txt" | httpx -silent -status-code -title -mc 200,201,202,204,301,302,401,403 > "$OUT/endpoints-live.txt"

# 401/403 endpoints — auth needed = potential auth bypass targets
grep -E '401|403' "$OUT/endpoints-live.txt" > "$OUT/endpoints-protected.txt"

# 200 endpoints without auth = potential IDOR / info disclosure
grep '200' "$OUT/endpoints-live.txt" > "$OUT/endpoints-public.txt"

Output template

loot/target.com/js/
├── js-urls.txt              (list of all JS files)
├── files/                   (downloaded JS)
│   └── *.js
├── endpoints-raw.txt        (LinkFinder output)
├── endpoints-absolute.txt   (normalized URLs)
├── endpoints-live.txt       (httpx-probed)
├── endpoints-protected.txt  (401/403 — auth bypass candidates)
├── endpoints-public.txt     (200 without auth)
├── secrets-raw.txt          (SecretFinder)
├── trufflehog.jsonl
├── noseyparker.txt
├── jsluice-urls.jsonl
├── jsluice-secrets.jsonl
├── sourcemaps-exposed.txt
├── source/                  (decompiled from source maps if exposed)
└── graphql-operations.txt

High-value findings — what to do next

Finding	Next skill	Potential payout
Hardcoded AWS key	[[cloud-misconfig]]	$$$$ (S3 access, IAM enum)
Exposed source map	Manual code review	$$$ (logic bug treasure)
Internal hostname leaked	[[ssrf]]	$$$$
Admin endpoint visible but 401	[[auth-bypass]]	$$$$
GraphQL operation names + schema	[[graphql]]	$$$$
Stripe / Twilio / etc. test key	Account in their system	$ — verify scope first
Postman collection URL	Manual review	$$ — endpoint goldmine

Cross-references

• [[asset-discovery]] — runs before this
• [[content-discovery]] — fuzz endpoints found in JS
• [[idor-hunting]] — test discovered API routes for IDOR
• [[graphql]] — exploit embedded GraphQL ops
• [[cloud-misconfig]] — abuse leaked cloud credentials

Common pitfalls

1. Trusting LinkFinder blindly. It produces false positives (/foo/bar inside strings). Validate with httpx.
2. Ignoring .map files. Source maps are often left exposed by accident — high-value.
3. Only analyzing the main bundle. Modern apps chunk-load (chunks/12345.js); analyze all.
4. Treating expired AWS keys as worthless. Even expired keys reveal account ID + naming conventions.
5. Not re-running on deploys. New release → new JS → new endpoints. Continuous monitoring is critical.

Pro tips

• JS files often Cache-Control: immutable — fingerprints are stable, so MD5-hash them and diff over time.
• Webpack chunks are named by hash but the hash → original name mapping is in the entry bundle.
• Look for process.env.NEXT_PUBLIC_* references in Next.js — leaks env vars.
• Vue apps may expose Vuex state via window object — check window.__INITIAL_STATE__.
• Service worker JS (/sw.js) often caches API URLs — easy endpoint mine.

Anti-anti-bot

Some apps obfuscate / minify aggressively. Beautify before analysis:

# js-beautify
npm install -g js-beautify
js-beautify -r "$OUT/files/"*.js

# Or use jsnice.org (online, manual)
# Or webcrack — handles webpack + obfuscators
npm install -g webcrack
webcrack "$OUT/files/main.bundle.js" -o "$OUT/files/main.deobfuscated.js"