loading
Loading content
loading
Discovery
Extract URLs, paths, and secrets from JavaScript with a syntax tree.
overview
jsluice reads JavaScript with a real parser, not regex. It builds a syntax tree and walks it for URLs, paths, and secrets, including endpoints assembled from concatenation that flat pattern tools miss.
Modes cover urls, secrets, tree, query, and format. Supply --patterns for custom secret formats, --resolve-paths for absolute endpoints, --unique to de-dupe, and --concurrency for folders of scripts.
Trickest provides jsluice as a managed Discovery node. File or folder of JS in, FILE and FOLDER results out. Collect scripts with getjs first; hand recovered URLs to a prober. Prefer LinkFinder for lighter regex-only endpoint pulls.
source github.com/BishopFox/jsluice
use cases
Run urls mode over a folder of scripts to recover API routes and paths, including ones built from concatenation that regex tools like LinkFinder skip.
Run secrets mode to surface API keys and tokens left in bundles, and supply a --patterns JSON file to match project-specific token formats.
Pass a base URL to --resolve-paths so jsluice turns the relative paths it finds into absolute endpoints ready for a prober to hit.
Use query mode with a --query expression to extract exactly the syntax nodes you care about, or tree mode to inspect the parse tree first.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | · | Mode to run (urls, secrets, tree, query, format). |
| input-file | FILE | · | A JavaScript file to analyze. |
| input-folder | FOLDER | · | Folder of JavaScript files to analyze. |
| query | STRING | --query | Tree-sitter query to run, e.g. '(string) @matches'. |
| patterns | FILE | --patterns | JSON file of user-defined secret patterns to look for. |
| resolve-paths | STRING | --resolve-paths | Resolve relative paths using the absolute URL provided. |
| unique | BOOLEAN | --unique | Only output each URL once per input file. |
| concurrency | STRING | --concurrency | Number of files to process concurrently (default 1). |
Showing key inputs. jsluice exposes 17 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | · | Mode to run (available modes: urls, secrets, tree, query, format). |
| input-file | FILE | · | A JavaScript file to analyze. |
| input-folder | FOLDER | · | Folder including JavaScript files to analyze. |
| query | STRING | --query | Tree-sitter query to run; e.g. '(string) @matches'. |
| patterns | FILE | --patterns | JSON file containing user-defined secret patterns to look for. |
| resolve-paths | STRING | --resolve-paths | Resolve relative paths using the absolute URL provided. |
| unique | BOOLEAN | --unique | Only output each URL once per input file. |
| concurrency | STRING | --concurrency | Number of files to process concurrently (default 1). |
| warc | BOOLEAN | --warc | Treat the input files as WARC (Web ARChive) files. |
| cookie | STRING | --cookie | Cookies to use when making requests to the specified HTTP based arguments. |
| header | STRING | --header | Headers to use when making requests to HTTP based arguments (can be specified multiple times). |
| format | BOOLEAN | --format | Format source code in the output. |
| raw-output | BOOLEAN | --raw-output | Do not convert values to native types. |
| placeholder | STRING | --placeholder | Set the expression placeholder to a custom string (default 'EXPR'). |
| ignore-strings | BOOLEAN | --ignore-strings | Ignore matches from string literals. |
| include-source | BOOLEAN | --include-source | Include the source code where the URL was found. |
| include-filename | BOOLEAN | --include-filename | Include the filename in the output. |
example
# pull URLs from a folder of scripts, resolve relative paths, de-duplicatejsluice urls --resolve-paths https://example.com --unique ./scripts{"url":"https://example.com/api/v1/users","queryParams":["id"],"bodyParams":[],"method":"GET","type":"fetch"}{"url":"https://example.com/api/v1/login","queryParams":[],"bodyParams":["username","password"],"method":"POST","type":"fetch"}{"url":"https://example.com/graphql","queryParams":[],"bodyParams":["query"],"method":"POST","type":"fetch"}{"url":"/assets/app.min.js","queryParams":[],"bodyParams":[],"method":"GET","type":"script"}{"url":"/api/v1/config","queryParams":["env"],"bodyParams":[],"method":"GET","type":"xhr"}{"url":"wss://198.51.100.20/socket","queryParams":[],"bodyParams":[],"method":"GET","type":"websocket"}{"url":"https://203.0.113.40/upload","queryParams":[],"bodyParams":["file"],"method":"POST","type":"form"}guidance
Use jsluice when you already have JavaScript to mine and want a parser, not a regex. It reads files; it does not fetch them. Run a crawler or getjs first. Prefer LinkFinder for lightweight regex endpoint discovery.
Regex endpoint discovery in JS. jsluice uses a real parser and also extracts secrets.
Collects JavaScript file URLs from a target. Run it before jsluice to gather scripts to parse.
Regex secret hunting in JS. jsluice secrets mode is the parser-driven counterpart.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A folder of JS files feeds jsluice, which parses out URLs and passes them to httpx so only live endpoints land as output.
Facts on this page come from the live Trickest tool library.