JavaScript Analysis & Secret Extraction

Enumeration MED v1.0.0 updated 2026-06-17

Analyse client-side JavaScript files to extract API endpoints, secrets, tokens, internal paths, and business logic that reveal hidden attack surface.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/javascript-analysis

// checklist steps

jsanalysis-01

Collect JavaScript files from all sources

Gather all JavaScript file URLs from live crawling, web archives, and page source to build a comprehensive JS corpus.

getJS --url https://target.com --complete --output getjs-urls.txt
hakrawler -url https://target.com -js -depth 3 | grep '\.js' | sort -u > hakrawler-js.txt
gau target.com | grep '\.js$' | sort -u > gau-js.txt
cat getjs-urls.txt hakrawler-js.txt gau-js.txt | sort -u > all-js-files.txt

Include web archive sources to capture JS files that have since been removed. Deleted scripts often contain credentials that were meant to be rotated.

jsanalysis-02

Extract API endpoints with LinkFinder

Parse JavaScript files to discover hardcoded API routes, internal paths, and third-party service integrations.

python3 linkfinder.py -i https://target.com -d -o cli
cat all-js-files.txt | while read url; do python3 linkfinder.py -i "$url" -o cli; done | sort -u > linkfinder-endpoints.txt
cat linkfinder-endpoints.txt | grep -iE '(/api/|/v[0-9]/|/internal/|/admin/)' > api-routes.txt

LinkFinder uses regex-based extraction — review output manually to filter false positives. Pay special attention to paths containing /internal/, /admin/, and /debug/.

jsanalysis-03

Scan for credentials with SecretFinder

Search JavaScript files for API keys, tokens, passwords, and other hardcoded secrets using pattern matching.

python3 SecretFinder.py -i https://target.com/static/app.js -o cli
cat all-js-files.txt | while read url; do python3 SecretFinder.py -i "$url" -o cli; done > secretfinder-out.txt
nuclei -l all-js-files.txt -t exposures/tokens/ -o nuclei-secrets.txt

Validate every finding — not all pattern matches are real secrets. Test extracted API keys against their respective services to confirm they are active.

jsanalysis-04

Beautify and manually review JavaScript

Deobfuscate and beautify minified JavaScript files to enable manual code review for business logic flaws and hidden functionality.

curl -sk https://target.com/static/app.min.js | js-beautify > app-beautified.js
cat all-js-files.txt | while read url; do curl -sk "$url" | js-beautify > "$(echo $url | md5sum | cut -d' ' -f1).js"; done
grep -rniE '(admin|debug|hidden|secret|internal|bypass|todo|fixme|hack)' *.js

Search for developer comments (TODO, FIXME, HACK) — they often reveal known vulnerabilities or temporary bypasses that were never removed.

jsanalysis-05

Detect and download source maps

Check for exposed JavaScript source maps that reveal the original unminified source code, directory structure, and component names.

curl -sk https://target.com/static/app.min.js | grep -oE 'sourceMappingURL=\S+'
curl -sk https://target.com/static/app.min.js.map -o sourcemap.json
cat all-js-files.txt | while read url; do curl -sk "${url}.map" -o /dev/null -w '%{http_code} %{url_effective}\n'; done | grep '^200'

Source maps expose the entire original source tree. If you find one, you effectively have the application source code — treat it as a code review engagement.

jsanalysis-06

Analyse webpack chunks and bundles

Extract and analyse webpack chunk files to discover lazily-loaded routes, feature flags, and modules not reachable through normal navigation.

curl -sk https://target.com/static/app.js | grep -oE '[0-9]+:\s*"[a-f0-9]+"' | head -20
curl -sk https://target.com | grep -oE 'src="[^"]*chunk[^"]*\.js"' | sed 's/src="//;s/"//'
cat all-js-files.txt | grep -iE '(chunk|vendor|runtime)' | while read url; do curl -sk "$url" | grep -oE '"/(api|internal|admin)[^"]*"'; done

Webpack chunks often contain admin panels, feature-flagged functionality, and internal tools that are loaded conditionally. Enumerate all chunk IDs systematically.

jsanalysis-07

Analyse DOM sinks for XSS vectors

Identify dangerous DOM manipulation patterns in JavaScript that can lead to DOM-based cross-site scripting.

grep -rniE '(innerHTML|outerHTML|document\.write|eval\(|setTimeout\(|setInterval\(|Function\()' *.js
grep -rniE '(location\.hash|location\.search|document\.referrer|window\.name|postMessage)' *.js
cat all-js-files.txt | while read url; do curl -sk "$url" | grep -cE '(innerHTML|eval|document\.write)'; done

Trace the data flow from sources (location.hash, document.referrer) to sinks (innerHTML, eval). A confirmed source-to-sink path without sanitisation is a DOM XSS vulnerability.

Overview

Client-side JavaScript is a goldmine for reconnaissance. Modern web applications ship significant business logic, API integrations, and sometimes credentials directly to the browser. Thorough JavaScript analysis consistently uncovers attack surface that other enumeration techniques miss entirely.

Analysis workflow

Follow this progression for maximum coverage:

Collect — gather all JS files from live pages, archives, and crawling
Extract — pull endpoints, secrets, and configuration data automatically
Deobfuscate — beautify minified code and download source maps
Review — manually audit for business logic, DOM sinks, and hidden features

High-value patterns

AWS keys (AKIA...), Google API keys, Firebase credentials
Internal API endpoints with /internal/, /admin/, /debug/ prefixes
Feature flags and environment toggles (isAdmin, debugMode, betaFeature)
Hardcoded JWT secrets or signing configurations
WebSocket endpoints and real-time communication channels

// references

← All checklists JSON ↗