Vulnerability Scanning
Analyze JavaScript Code
Retrieve JavaScript from a URL list, unpack it, and mine endpoints, wordlists, CVEs, secrets, and insecure client-side patterns in one nestable pass.
What Analyze JavaScript Code does
Client-side JavaScript hides endpoints, secrets, outdated libraries, and insecure patterns that a minified bundle hides from a casual read. This module retrieves JavaScript from a URL list, unpacks it with sourcemaps, beautify, and deobfuscate, then mines endpoints, wordlists, CVEs, and secrets in one pass. It is a retrieve-and-unpack process, not a parser you point at a local dump.
You pass a file of JavaScript URLs. The module retrieves each script and keeps the original location (example.com/, cdn.example.com/), extracts sourcemaps when they are present, then beautifies and deobfuscates what it has. From the unpacked code it mines hidden endpoints and methods, builds custom path and parameter wordlists, checks outdated dependencies for CVEs when it can name them, matches secrets in the unpacked JS, and flags insecure client-side patterns. This is a nestable retrieve-and-unpack process. It is not a parser you point at a local dump.
Where it fits in the pipeline
Pipeline guidance
Upstream: Discover Paths via Crawling, or any list of script URLs. Probe for Web Servers is the usual liveness step before that crawl. Bring a header when you authenticate the SPA.
Downstream: Endpoints and wordlists feed Fuzz Web Applications for Vulnerabilities and Discover Paths via Directory Brute Force. Endpoints land in a shape fuzz can take as url-details. Findings and unpacked code feed Generate Scan Report.
Parallel: This is not a substitute for the crawl, for Scan for Exposed Secrets, or for live fuzz. It reads retrieved JS. It does not walk the app, read live HTML, or inject payloads.
When to use this
Nest this after you have a file of JavaScript URLs. The module cannot invent bundles you never loaded, so crawl or list scripts first. Use it when you want the retrieve-and-unpack pass before you fuzz or dirbust with the wordlists it builds.
Inputs and outputs
- Optional
headerfor authenticated fetches, plusin-scopeandout-of-scopefiles (URLs, paths, or regular expressions) that filter which endpoints get extracted.
Data
The tables this module produces. Sample rows are illustrative.
Hidden endpoints and HTTP methods mined from unpacked JavaScript.
urlurl | methodtext | sourcetext | |
|---|---|---|---|
| 1 | https://api.example.com/v1/users | GET | https://app.example.com/assets/app.min.js |
| 2 | https://api.example.com/v1/admin | POST | https://app.example.com/assets/app.min.js |
| 3 | https://cdn.example.com/internal/debug | GET | https://cdn.example.com/assets/vendor.js |
Custom path and parameter wordlists built from the unpacked JavaScript.
wordtext | typetext | |
|---|---|---|
| 1 | /api/v1/internal/users | path |
| 2 | debug_token | parameter |
| 3 | /admin/export | path |
Outdated client-side dependencies with named CVEs.
dependencytext | versiontext | cvetext | severitytext | |
|---|---|---|---|---|
| 1 | jquery | 2.2.3 | CVE-2015-9251 | medium |
| 2 | angular | 1.4.7 | CVE-2019-10768 | medium |
| 3 | lodash | 4.17.4 | CVE-2018-16487 | high |
Secrets and insecure client-side pattern hits found in the unpacked JavaScript.
findingtext | locationurl | severitytext | typetext | lineint | |
|---|---|---|---|---|---|
| 1 | URI Secret | https://app.example.com/assets/app.min.js | info | secret | 142 |
| 2 | DOM Based XSS Candidate | https://app.example.com/assets/app.min.js | medium | insecure-pattern | 87 |
| 3 | Hardcoded API Token | https://cdn.example.com/assets/vendor.js | info | secret | 312 |
How it differs from similar modules
Why this is not it
Live crawl. Nest this after you have JS URLs. The crawl maps linked paths; this retrieves and unpacks the scripts you already listed.
Why this is not it
Pattern-matches HTTP response bodies. This matches patterns in unpacked JS. A key in index.html is that sibling; a key in app.min.js is this module.
Why this is not it
Live payloads. This feeds wordlists and endpoints. It does not replace fuzz.
Why this is not it
Stack CVEs on ten named products after web fingerprinting. This is client-side mining, stack-agnostic.
Why this is not it
A copy-and-run Library graph. Not this nestable face.
questions
Analyze JavaScript Code questions
Nest Analyze JavaScript Code in a workflow
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
See Trickest in Action
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.