jxscout: JavaScript analysis for endpoint and secret discovery

jxscout · MIT

jxscout analyses JavaScript to recover the things front ends leak into their bundles: API endpoints, parameter names, and hardcoded values. Modern applications ship their routing and much of their contract to the browser, and jxscout is the step in Tandera’s pipeline that reads it systematically.

Core commands

# analyse a single bundle
jxscout analyze https://example.com/static/app.js

# every script referenced by a page
jxscout analyze --page https://example.com

# a local file
jxscout analyze ./app.bundle.js --json

Output

Structured JSON: recovered endpoints, parameter names, and candidate constants, each with the source file and offset so a finding can point at the exact location in the bundle.

Where it sits in Tandera

jxscout runs in the analyze phase of recon_web_lite and recon_api, over the JavaScript that katana retrieved. It sits alongside linkfinder and trufflehog, and the three divide the same input: linkfinder for route extraction, trufflehog for verified secrets, jxscout for the structured endpoint-and-parameter model that feeds API shadow-endpoint synthesis.

Because analysis is entirely of already-downloaded content — nothing is sent to the target — jxscout is permitted in the NonIntrusive lite flow.

Using it in a pentest

Bundles describe the API better than the API documents itself. The endpoints and parameters recovered here are the application’s real contract, including routes the UI never exercises. Feed them to httpx and arjun and test what is reachable without authorisation.

Correlate constants with verified secrets. jxscout surfaces candidate constants; trufflehog tells you which are live credentials. A value flagged by both, in the same bundle, is a confirmed finding with an exact location.

Source maps change everything. When .map files are served, analysis runs against original source rather than minified output, and the recovered names are the developers’ real ones. Always check whether they are exposed — and note it, because a public source map is itself a disclosure worth reporting.