Analyze JavaScript Code

Identify vulnerabilities, collect useful data, and prepare JavaScript code for manual review

Vulnerability Scanning

Created by

mhmdiaa-trickest

Last updated

11/7/2024

Input Parameters

urls · file · required

List of script URLs

header · string

Header(s) to include in HTTP requests

in-scope · file

List of URLs, paths, or regular expressions used to identify endpoints for extraction

out-of-scope · file

List of URLs, paths, or regular expressions to ignore during endpoint extraction

Outputs

endpointscodepath-wordlistparameter-wordlistfindings

Analyze JavaScript Code

Description

Retrieve JavaScript code from a list of URLs while preserving its original location structure. When available, extract sourcemaps to obtain non-minified code, then beautify and deobfuscate all code. Analyze the code to discover hidden endpoints, generate custom path and parameter brute-force wordlists based on script content, and scan for vulnerabilities by identifying outdated dependencies, insecure code patterns, and exposed secrets.

Features

• Prepares code for manual review by downloading all files to a single location, extracting sourcemaps when available to obtain original, non-minified code.
• Simplifies code review by beautifying and deobfuscating code, and applying transformations such as unpacking arrays and removing redundant proxy functions.
• Extracts hidden endpoints and paths from the code, including parameters and request methods.
• Generates a custom wordlist for path discovery based on identified endpoints.
• Creates a custom wordlist for parameter discovery using found endpoints and variable names.
• Checks for outdated dependencies and identifies associated CVEs when available.
• Scans for a wide range of exposed secrets.
• Analyzes code for insecure patterns and client-side vulnerabilities.

Inputs

Required

• urls: List of JavaScript code URLs (non-JS URLs will be automatically filtered out)

https://example.com/script.js
https://cdn.example.com/assets/app.min.js
https://another-example.com/js/main.js

Outputs

• findings: JSONLines records of finding details

{"finding": "Potential exposed secret: URI","location": "https://cdn.example.com/assets/app.min.js","severity": "unknown","hostname": "cdn.example.com","domain_name": "example.com","method": "GET","matches": ["http://admin:[e-mail]"]}
{"finding": "Outdated JavaScript component: jquery 2.2.3","location": "https://example.com/script.js","severity": "medium","hostname": "example.com","domain_name": "example.com","method": "GET","matches": ["CVE-2015-9251","CVE-2019-11358","CVE-2020-11023","CVE-2020-11022"]}
{"finding": "DOM Based XSS","location": "https://another-example.com/js/main.js","severity": "medium","description": "Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script> which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL.","hostname": "another-example.com","domain_name": "another-example.com","method": "GET","matches": ["line 27"]}

• endpoints: JSONLines records of endpoint details, including parameters and request methods

{"url": "/api/login", "query_parameter": "", "body_parameter": "username", "method": "POST", "source_files": ["https://another-example.com/js/main.js"]}
{"url": "/api/login", "query_parameter": "", "body_parameter": "password", "method": "POST", "source_files": ["https://another-example.com/js/main.js"]}
{"url": "/api/users", "query_parameter": "id", "body_parameter": "", "method": "GET", "source_files": ["https://another-example.com/js/main.js"]}
{"url": "/Dashboard", "query_parameter": "", "body_parameter": "", "method": "", "source_files": ["https://another-example.com/js/main.js"]}

• path-wordlist: List of possible paths derived from identified endpoints

api/login/
api/users
Dashboard

• parameter-wordlist: List of possible parameters derived from identified endpoints and variable names within the code

username
password
id
url
role

• code: Folder containing the downloaded and analyzed code, with files beautified, deobfuscated, simplified, and sourcemaps resolved where available.

code/
├── example.com/
│   └── app.js             # Original source from resolved sourcemap
├── cdn.example.com/
│   ├── script.js          # Beautified and deobfuscated version of the original minified script
└── another-example.com/
    └── main.js

Changelog

• v1.0.0
  • Initial release
• v1.0.1
  • Added header input
• v1.0.2
  • Improved source map handling for locations that have no corresponding content available
• v2.0.0
  • Update endpoints output format to be compatible with the url-details format
  • Add in-scope and out-of-scope inputs for filtering extracted endpoints