Discovery
Mine JavaScript for URLs and secrets with a real parser
Extract URLs, paths, and secrets from JavaScript with a syntax tree.
overview
What jsluice does
jsluice reads JavaScript with a real parser, not regex. It builds a syntax tree and walks it for URLs, paths, and secrets, including endpoints assembled from concatenation that flat pattern tools miss.
Modes cover urls, secrets, tree, query, and format. Supply --patterns for custom secret formats, --resolve-paths for absolute endpoints, --unique to de-dupe, and --concurrency for folders of scripts.
Trickest provides jsluice as a managed Discovery node. File or folder of JS in, FILE and FOLDER results out. Collect scripts with getjs first; hand recovered URLs to a prober. Prefer LinkFinder for lighter regex-only endpoint pulls.
source github.com/BishopFox/jsluice
use cases
Where jsluice fits
Pull endpoints out of JavaScript
Run urls mode over a folder of scripts to recover API routes and paths, including ones built from concatenation that regex tools like LinkFinder skip.
Find secrets in client-side code
Run secrets mode to surface API keys and tokens left in bundles, and supply a --patterns JSON file to match project-specific token formats.
Resolve relative paths to full URLs
Pass a base URL to --resolve-paths so jsluice turns the relative paths it finds into absolute endpoints ready for a prober to hit.
Run custom tree-sitter queries
Use query mode with a --query expression to extract exactly the syntax nodes you care about, or tree mode to inspect the parse tree first.
reference
jsluice inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | · | Mode to run (urls, secrets, tree, query, format). |
| input-file | FILE | · | A JavaScript file to analyze. |
| input-folder | FOLDER | · | Folder of JavaScript files to analyze. |
| query | STRING | --query | Tree-sitter query to run, e.g. '(string) @matches'. |
| patterns | FILE | --patterns | JSON file of user-defined secret patterns to look for. |
| resolve-paths | STRING | --resolve-paths | Resolve relative paths using the absolute URL provided. |
| unique | BOOLEAN | --unique | Only output each URL once per input file. |
| concurrency | STRING | --concurrency | Number of files to process concurrently (default 1). |
Showing key inputs. jsluice exposes 17 inputs in total.
Full flag reference (17 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | · | Mode to run (available modes: urls, secrets, tree, query, format). |
| input-file | FILE | · | A JavaScript file to analyze. |
| input-folder | FOLDER | · | Folder including JavaScript files to analyze. |
| query | STRING | --query | Tree-sitter query to run; e.g. '(string) @matches'. |
| patterns | FILE | --patterns | JSON file containing user-defined secret patterns to look for. |
| resolve-paths | STRING | --resolve-paths | Resolve relative paths using the absolute URL provided. |
| unique | BOOLEAN | --unique | Only output each URL once per input file. |
| concurrency | STRING | --concurrency | Number of files to process concurrently (default 1). |
| warc | BOOLEAN | --warc | Treat the input files as WARC (Web ARChive) files. |
| cookie | STRING | --cookie | Cookies to use when making requests to the specified HTTP based arguments. |
| header | STRING | --header | Headers to use when making requests to HTTP based arguments (can be specified multiple times). |
| format | BOOLEAN | --format | Format source code in the output. |
| raw-output | BOOLEAN | --raw-output | Do not convert values to native types. |
| placeholder | STRING | --placeholder | Set the expression placeholder to a custom string (default 'EXPR'). |
| ignore-strings | BOOLEAN | --ignore-strings | Ignore matches from string literals. |
| include-source | BOOLEAN | --include-source | Include the source code where the URL was found. |
| include-filename | BOOLEAN | --include-filename | Include the filename in the output. |
example
Run jsluice
# pull URLs from a folder of scripts, resolve relative paths, de-duplicatejsluice urls --resolve-paths https://example.com --unique ./scripts{"url":"https://example.com/api/v1/users","queryParams":["id"],"bodyParams":[],"method":"GET","type":"fetch"}{"url":"https://example.com/api/v1/login","queryParams":[],"bodyParams":["username","password"],"method":"POST","type":"fetch"}{"url":"https://example.com/graphql","queryParams":[],"bodyParams":["query"],"method":"POST","type":"fetch"}{"url":"/assets/app.min.js","queryParams":[],"bodyParams":[],"method":"GET","type":"script"}{"url":"/api/v1/config","queryParams":["env"],"bodyParams":[],"method":"GET","type":"xhr"}{"url":"wss://198.51.100.20/socket","queryParams":[],"bodyParams":[],"method":"GET","type":"websocket"}{"url":"https://203.0.113.40/upload","queryParams":[],"bodyParams":["file"],"method":"POST","type":"form"}guidance
Choosing jsluice
Use jsluice when you already have JavaScript to mine and want a parser, not a regex. It reads files; it does not fetch them. Run a crawler or getjs first. Prefer LinkFinder for lightweight regex endpoint discovery.
LinkFinder
Regex endpoint discovery in JS. jsluice uses a real parser and also extracts secrets.
getjs
Collects JavaScript file URLs from a target. Run it before jsluice to gather scripts to parse.
secretfinder
Regex secret hunting in JS. jsluice secrets mode is the parser-driven counterpart.
faq
jsluice questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run jsluice yourself
A folder of JS files feeds jsluice, which parses out URLs and passes them to httpx so only live endpoints land as output.
Facts on this page come from the live Trickest tool library.