# jxscout: JavaScript analysis for endpoint and secret discovery

> What jxscout does in Tandera JavaScript analysis, how it complements LinkFinder and TruffleHog, and how to work its output in a pentest.

`jxscout` analyses JavaScript to recover the things front ends leak into their bundles: API endpoints, parameter names, and hardcoded values. Modern applications ship their routing and much of their contract to the browser, and jxscout is the step in Tandera's pipeline that reads it systematically.

## Core commands

```bash
# analyse a single bundle
jxscout analyze https://example.com/static/app.js

# every script referenced by a page
jxscout analyze --page https://example.com

# a local file
jxscout analyze ./app.bundle.js --json
```

## Output

Structured JSON: recovered endpoints, parameter names, and candidate constants, each with the source file and offset so a finding can point at the exact location in the bundle.

## Where it sits in Tandera

jxscout runs in the **analyze** phase of `recon_web_lite` and `recon_api`, over the JavaScript that `katana` retrieved. It sits alongside `linkfinder` and `trufflehog`, and the three divide the same input: linkfinder for route extraction, trufflehog for verified secrets, jxscout for the structured endpoint-and-parameter model that feeds API shadow-endpoint synthesis.

Because analysis is entirely of already-downloaded content — nothing is sent to the target — jxscout is permitted in the `NonIntrusive` lite flow.

## Using it in a pentest

**Bundles describe the API better than the API documents itself.** The endpoints and parameters recovered here are the application's real contract, including routes the UI never exercises. Feed them to `httpx` and `arjun` and test what is reachable without authorisation.

**Correlate constants with verified secrets.** jxscout surfaces candidate constants; `trufflehog` tells you which are live credentials. A value flagged by both, in the same bundle, is a confirmed finding with an exact location.

**Source maps change everything.** When `.map` files are served, analysis runs against original source rather than minified output, and the recovered names are the developers' real ones. Always check whether they are exposed — and note it, because a public source map is itself a disclosure worth reporting.

---

Canonical: https://tandera.io/tools/jxscout
This page as markdown: https://tandera.io/tools/jxscout.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.