loading
Loading content
loading
Discovery
Reconstruct JavaScript source trees from Sourcemap files.
overview
sourcemapper downloads a JavaScript sourcemap and reconstructs the original source tree the bundler embedded inside it. Production builds often leave .js.map files next to minified bundles; when they do, the map exposes readable modules, paths, and comments.
Pass -url for a map URL, or -jsurl for a script URL when the map is referenced from the bundle. -url and -jsurl cannot be combined. Optional -proxy and -header mirror a curl-style fetch; -insecure skips TLS verification for lab hosts with broken certificates.
Run it after a crawler surfaces .map references. Recovered sources write to a FOLDER for review of endpoints, secrets, and internal paths that minified bundles hide.
use cases
Fetch a discovered sourcemap URL and write the original file tree for offline review of modules the minified bundle hid.
Pass -jsurl when you have the bundled JavaScript and need sourcemapper to locate and pull the linked map automatically.
Search the rebuilt tree for API routes, admin screens, and feature flags that never appear in the minified output.
Set -proxy and -header when the map is only reachable through an authenticated or corporate egress path.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -url | URL to the Sourcemap file (cannot be used with jsurl). |
| jsurl | STRING | -jsurl | URL to JavaScript file (cannot be used with url). |
| sourcemap | FILE | -url | Path to a local Sourcemap file (cannot be used with jsurl). |
| proxy | STRING | -proxy | Proxy URL for the fetch. |
| header | STRING | -header | Extra request header, similar to curl -H (repeatable). |
| insecure | BOOLEAN | -insecure | Ignore invalid TLS certificates. |
Showing key inputs. sourcemapper exposes 6 inputs in total.
example
# rebuild sources from a public sourcemap on example.comsourcemapper -url https://example.com/static/app.js.map[+] Retrieving sourcemap from https://example.com/static/app.js.map[+] Sourcemap retrieved, unpacking sources...[+] Writing src/components/App.js[+] Writing src/api/client.js[+] Writing src/pages/Login.js[+] Writing src/utils/config.js[+] Writing webpack:///external/vendor.js[+] Done: 48 files under ./example.com/guidance
Reach for sourcemapper when a crawler finds .map files or JavaScript bundles with sourcemaps still attached. It reconstructs source; it does not crawl. Run it after katana or a JS finder. To pull endpoints from minified JS without a map, use a JS-link extractor instead.
Crawls a site and surfaces .js and .js.map references. Run it before sourcemapper to find the maps.
Scrapes JavaScript for subdomains and secrets without rebuilding source. Complements full source recovery.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A target feeds katana, which surfaces sourcemap references that sourcemapper rebuilds into an original source tree written as output.
Facts on this page come from the live Trickest tool library.