{
  "slug": "javascript-analysis",
  "title": "JavaScript Analysis & Secret Extraction",
  "phase": "Enumeration",
  "description": "Analyse client-side JavaScript files to extract API endpoints, secrets, tokens, internal paths, and business logic that reveal hidden attack surface.",
  "difficulty": "medium",
  "tags": [
    "enumeration",
    "javascript",
    "secrets",
    "source-analysis",
    "client-side"
  ],
  "tools": [
    "LinkFinder",
    "SecretFinder",
    "getJS",
    "hakrawler",
    "nuclei"
  ],
  "steps": [
    {
      "id": "jsanalysis-01",
      "title": "Collect JavaScript files from all sources",
      "description": "Gather all JavaScript file URLs from live crawling, web archives, and page source to build a comprehensive JS corpus.",
      "commands": [
        "getJS --url https://target.com --complete --output getjs-urls.txt",
        "hakrawler -url https://target.com -js -depth 3 | grep '\\.js' | sort -u > hakrawler-js.txt",
        "gau target.com | grep '\\.js$' | sort -u > gau-js.txt",
        "cat getjs-urls.txt hakrawler-js.txt gau-js.txt | sort -u > all-js-files.txt"
      ],
      "notes": "Include web archive sources to capture JS files that have since been removed. Deleted scripts often contain credentials that were meant to be rotated."
    },
    {
      "id": "jsanalysis-02",
      "title": "Extract API endpoints with LinkFinder",
      "description": "Parse JavaScript files to discover hardcoded API routes, internal paths, and third-party service integrations.",
      "commands": [
        "python3 linkfinder.py -i https://target.com -d -o cli",
        "cat all-js-files.txt | while read url; do python3 linkfinder.py -i \"$url\" -o cli; done | sort -u > linkfinder-endpoints.txt",
        "cat linkfinder-endpoints.txt | grep -iE '(/api/|/v[0-9]/|/internal/|/admin/)' > api-routes.txt"
      ],
      "notes": "LinkFinder uses regex-based extraction — review output manually to filter false positives. Pay special attention to paths containing /internal/, /admin/, and /debug/."
    },
    {
      "id": "jsanalysis-03",
      "title": "Scan for credentials with SecretFinder",
      "description": "Search JavaScript files for API keys, tokens, passwords, and other hardcoded secrets using pattern matching.",
      "commands": [
        "python3 SecretFinder.py -i https://target.com/static/app.js -o cli",
        "cat all-js-files.txt | while read url; do python3 SecretFinder.py -i \"$url\" -o cli; done > secretfinder-out.txt",
        "nuclei -l all-js-files.txt -t exposures/tokens/ -o nuclei-secrets.txt"
      ],
      "notes": "Validate every finding — not all pattern matches are real secrets. Test extracted API keys against their respective services to confirm they are active."
    },
    {
      "id": "jsanalysis-04",
      "title": "Beautify and manually review JavaScript",
      "description": "Deobfuscate and beautify minified JavaScript files to enable manual code review for business logic flaws and hidden functionality.",
      "commands": [
        "curl -sk https://target.com/static/app.min.js | js-beautify > app-beautified.js",
        "cat all-js-files.txt | while read url; do curl -sk \"$url\" | js-beautify > \"$(echo $url | md5sum | cut -d' ' -f1).js\"; done",
        "grep -rniE '(admin|debug|hidden|secret|internal|bypass|todo|fixme|hack)' *.js"
      ],
      "notes": "Search for developer comments (TODO, FIXME, HACK) — they often reveal known vulnerabilities or temporary bypasses that were never removed."
    },
    {
      "id": "jsanalysis-05",
      "title": "Detect and download source maps",
      "description": "Check for exposed JavaScript source maps that reveal the original unminified source code, directory structure, and component names.",
      "commands": [
        "curl -sk https://target.com/static/app.min.js | grep -oE 'sourceMappingURL=\\S+'",
        "curl -sk https://target.com/static/app.min.js.map -o sourcemap.json",
        "cat all-js-files.txt | while read url; do curl -sk \"${url}.map\" -o /dev/null -w '%{http_code} %{url_effective}\\n'; done | grep '^200'"
      ],
      "notes": "Source maps expose the entire original source tree. If you find one, you effectively have the application source code — treat it as a code review engagement."
    },
    {
      "id": "jsanalysis-06",
      "title": "Analyse webpack chunks and bundles",
      "description": "Extract and analyse webpack chunk files to discover lazily-loaded routes, feature flags, and modules not reachable through normal navigation.",
      "commands": [
        "curl -sk https://target.com/static/app.js | grep -oE '[0-9]+:\\s*\"[a-f0-9]+\"' | head -20",
        "curl -sk https://target.com | grep -oE 'src=\"[^\"]*chunk[^\"]*\\.js\"' | sed 's/src=\"//;s/\"//'",
        "cat all-js-files.txt | grep -iE '(chunk|vendor|runtime)' | while read url; do curl -sk \"$url\" | grep -oE '\"/(api|internal|admin)[^\"]*\"'; done"
      ],
      "notes": "Webpack chunks often contain admin panels, feature-flagged functionality, and internal tools that are loaded conditionally. Enumerate all chunk IDs systematically."
    },
    {
      "id": "jsanalysis-07",
      "title": "Analyse DOM sinks for XSS vectors",
      "description": "Identify dangerous DOM manipulation patterns in JavaScript that can lead to DOM-based cross-site scripting.",
      "commands": [
        "grep -rniE '(innerHTML|outerHTML|document\\.write|eval\\(|setTimeout\\(|setInterval\\(|Function\\()' *.js",
        "grep -rniE '(location\\.hash|location\\.search|document\\.referrer|window\\.name|postMessage)' *.js",
        "cat all-js-files.txt | while read url; do curl -sk \"$url\" | grep -cE '(innerHTML|eval|document\\.write)'; done"
      ],
      "notes": "Trace the data flow from sources (location.hash, document.referrer) to sinks (innerHTML, eval). A confirmed source-to-sink path without sanitisation is a DOM XSS vulnerability."
    }
  ],
  "references": [
    "https://github.com/GerbenJavado/LinkFinder",
    "https://github.com/m4ll0k/SecretFinder",
    "https://github.com/003random/getJS",
    "https://github.com/hakluke/hakrawler",
    "https://portswigger.net/web-security/dom-based"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}