JavaScript analysis

SkillWeb & browsing

Mine JavaScript for endpoints, params, secrets, and hidden functionality. Load on SPAs, heavy JS apps, after crawling, or "analyze the JS". Signals: bundled JS (webpack/main.*.js), API calls in JS, source maps, /static/js, front-end frameworks.

Use JavaScript analysis in Claude, ChatGPT or Ahel Desktop

Free. Sign in, add JavaScript analysis and connect your AI. About a minute.

Claude ChatGPT Ahel Desktop

Also: Claude Code · Cursor · Codex

Then ask your AI: use the JavaScript analysis skill

Details

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; Ahel provides instructions and does not run this skill.

No other account needed.

Add Ahel to your AI once: Claude, ChatGPT, Cursor, Claude Code or Codex. Then ask it to use this.

JavaScript analysisStart free

What this skill tells your AI

The instructions your AI receives, as published by noorqureshi/sploitagent in skills/recon/recon-js-analysis/SKILL.md and read by Ahel’s review.

When it applies

The app is JS-heavy (SPA). The front-end bundle is a map of the backend: it references API endpoints, parameters, feature flags, roles, and sometimes secrets — much of it not linked in the UI.

Why it works

Client code must know how to call the server, so endpoints/params are embedded in JS. Bundlers also occasionally ship source maps (full original source) and developers leave keys/comments.

Method

Collect all JS: katana -jc, subjs, or crawl; grab every .js (incl. lazy-loaded chunks).
Extract endpoints/params: linkfinder/jsluice pull URLs, paths, and param names from bundles.
Hunt secrets & flags: grep for apiKey|token|secret|internal|admin|debug, feature flags, and role checks done client-side (server may not enforce them → BOLA/BFLA leads).
Source maps: if .map files ship, reconstruct original source (source-map tools) → full whitebox-ish view.
Feed results: new endpoints → api-*; client-only auth checks → api-bola; secrets → validate.

Gotchas

Client-side "admin" gating usually isn't enforced server-side — test the endpoints directly.
De-obfuscate/beautify minified bundles before grepping (js-beautify).
Lazy-loaded chunks hide the juicy routes — enumerate all chunk files, not just main.js.

Verify success

Endpoints/params/secrets extracted from JS that weren't in the UI — new, testable surface.

References

LinkFinder/jsluice; katana; "JS recon" bug-bounty methodology.

Signals

GitHub stars: 20
Forks: 7
Last commit: Sep 2026

Advanced

Item type: skill
Key: recon-js-analysis
Source: github.com/noorqureshi/sploitagent

github.com/noorqureshi/sploitagent