A powerful Go-based tool that analyzes JavaScript files to discover endpoints, API URLs, tokens, and other sensitive information that might be exposed in client-side code. Special thanks for Timoria and RIGOLIT.
jsreader can detect various types of sensitive information:
- S3 Buckets - Potential public AWS S3 bucket URLs
- Firebase Resources:
- Firebase Database URLs
- Firebase Storage URLs
- Firebase Application URLs
- API Endpoints:
- General API endpoints
- API versions
- API subdomains
- API components
- GraphQL Endpoints - GraphQL API endpoints
- Authentication Endpoints - Authentication, OAuth, and user-related endpoints
- Telegram Bot Tokens - Exposed Telegram API tokens
- URLs in Variables - URLs stored in JavaScript variables
go install github.com/number731/jsreader@latestgit clone https://github.com/number731/jsreader.git
# Change to the project directory
cd jsreader
# Build the executable
go build -o jsreader.go
# Optional: Move to a directory in your PATH
sudo mv jsreader /usr/local/bin/JS Endp 7122 oint Finder provides several options for analyzing JavaScript files:
Usage:
jsreader [options]
Options:
-t int Number of threads to use (default 1)
-i string Path to file with list of JS URLs (one per line)
-f string Path to single JS file to analyze
-p Enable pipe mode (read from stdin)
-o string Output file to save results (.txt)
Analyze a single local JavaScript file:
jsreader -f /path/to/script.jsAnalyze a remote JavaScript file:
jsreader -f https://example.com/script.jsProcess multiple JavaScript files from a list:
jsreader -i urls.txt -t 5Process data from pipe:
cat urls.txt | jsreader -pSave results to a file:
jsreader -i urls.txt -o results.txtCombine with other tools:
cat domains.txt | katana -d 5 -jc | grep '\.js$' | jsreader -p
When running JS Endpoint Finder, results will be color-coded for easy identification:
- Red: S3 Buckets
- Yellow: Firebase resources
- Green: API endpoints
- Cyan: GraphQL endpoints
- Purple: Authentication endpoints
- Blue: URLs in variables
- Orange: Telegram tokens
- Teal: API subdomains
- Pink: API versions
- Magenta: API components
Example output:
[API] https://api.example.com/v1/users
Details: API endpoint - investigate available methods
Source: https://example.com/main.js
[Firebase DB] https://my-app.firebaseio.com/data
Details: Firebase service - check security rules
Source: https://example.com/main.js
[S3 Bucket] https://assets.s3-us-west-2.amazonaws.com/images
Details: Potential public S3 bucket - check permissions
Source: https://example.com/main.js
Contributions are welcome! Please feel free to submit a Pull Request.
This project is licensed under the MIT License - see the LICENSE file for details.