Discovery
Rebuild original JavaScript from exposed sourcemaps
Reconstruct JavaScript source trees from Sourcemap files.
overview
What sourcemapper does
sourcemapper downloads a JavaScript sourcemap and reconstructs the original source tree the bundler embedded inside it. Production builds often leave .js.map files next to minified bundles; when they do, the map exposes readable modules, paths, and comments.
Pass -url for a map URL, or -jsurl for a script URL when the map is referenced from the bundle. -url and -jsurl cannot be combined. Optional -proxy and -header mirror a curl-style fetch; -insecure skips TLS verification for lab hosts with broken certificates.
Run it after a crawler surfaces .map references. Recovered sources write to a FOLDER for review of endpoints, secrets, and internal paths that minified bundles hide.
use cases
Where sourcemapper fits
Recover sources from a public .map
Fetch a discovered sourcemap URL and write the original file tree for offline review of modules the minified bundle hid.
Follow a script URL to its map
Pass -jsurl when you have the bundled JavaScript and need sourcemapper to locate and pull the linked map automatically.
Review recovered paths for endpoints
Search the rebuilt tree for API routes, admin screens, and feature flags that never appear in the minified output.
Fetch maps through a proxy
Set -proxy and -header when the map is only reachable through an authenticated or corporate egress path.
reference
sourcemapper inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -url | URL to the Sourcemap file (cannot be used with jsurl). |
| jsurl | STRING | -jsurl | URL to JavaScript file (cannot be used with url). |
| sourcemap | FILE | -url | Path to a local Sourcemap file (cannot be used with jsurl). |
| proxy | STRING | -proxy | Proxy URL for the fetch. |
| header | STRING | -header | Extra request header, similar to curl -H (repeatable). |
| insecure | BOOLEAN | -insecure | Ignore invalid TLS certificates. |
Showing key inputs. sourcemapper exposes 6 inputs in total.
example
Run sourcemapper
# rebuild sources from a public sourcemap on example.comsourcemapper -url https://example.com/static/app.js.map[+] Retrieving sourcemap from https://example.com/static/app.js.map[+] Sourcemap retrieved, unpacking sources...[+] Writing src/components/App.js[+] Writing src/api/client.js[+] Writing src/pages/Login.js[+] Writing src/utils/config.js[+] Writing webpack:///external/vendor.js[+] Done: 48 files under ./example.com/guidance
Choosing sourcemapper
Reach for sourcemapper when a crawler finds .map files or JavaScript bundles with sourcemaps still attached. It reconstructs source; it does not crawl. Run it after katana or a JS finder. To pull endpoints from minified JS without a map, use a JS-link extractor instead.
katana
Crawls a site and surfaces .js and .js.map references. Run it before sourcemapper to find the maps.
subdomainizer
Scrapes JavaScript for subdomains and secrets without rebuilding source. Complements full source recovery.
faq
sourcemapper questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run sourcemapper yourself
A target feeds katana, which surfaces sourcemap references that sourcemapper rebuilds into an original source tree written as output.
Facts on this page come from the live Trickest tool library.