client-spa-endpoints

You extract API endpoints from JavaScript bundles by performing static analysis on downloaded JS files and source maps. This passive reconnaissance technique parses framework manifests to identify hidden application routes and infrastructure references without active probing.

Passive reconnaissance of SPA routes maps an application's attack surface by statically parsing JavaScript bundles. It is used to identify internal hostnames, private IPs, and API paths without triggering active security alerts or requiring intrusive crawling.

Yes, you can discover hidden admin routes and debug endpoints from React source maps. By extracting route definitions and leaked frontend configurations directly from the JS artifacts, you map the entire API surface before performing any active testing.

You find internal hostnames and cloud metadata endpoints by applying static analysis to client-side JavaScript bundles. This infrastructure mapping identifies private IP references and cloud configurations often leaked in frontend code during reconnaissance.

A limitation of static analysis for API discovery in single page applications is that it only extracts endpoints present in the downloaded JS bundles and source maps. It requires these artifacts to be accessible and does not evaluate dynamic runtime behavior or active server responses.