js-api-extract

Extract API endpoints, keys, and internal domains from JavaScript bundles.

1.6k|234|Updated Dec 7, 2019

Search Tags:#api #javascript #spa #fuzzing #js #bundle-analysis #endpoint-extraction

Ready to run

npx skills add https://github.com/wgpsec/AboutSecurity --skill js-api-extract

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: js-api-extract
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/recon/js-api-extract
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill js-api-extract

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Analyzing JavaScript front-end bundles to uncover hidden API endpoints, keys, internal domains, and WebSocket endpoints that are not discoverable via traditional directory or URL scanning.

Core Features & Use Cases

JS bundle analysis to reveal API paths, keys, domains, and WebSocket endpoints in SPA architectures.
Supports Vue/React/Angular front-ends and common bundlers like Webpack; reduces manual endpoint discovery time.
After discovery, feed results into api-semantic-fuzz for semantic fuzzing to validate endpoint behavior.

Quick Start

Analyze the target JavaScript bundle or deployed site to extract endpoints and credentials for subsequent fuzzing.

Frequently Asked Questions about js-api-extract

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract hidden API endpoints from JavaScript bundles?▼

To extract hidden API endpoints from JavaScript bundles, you must analyze the JS content and common patterns within SPA architectures. This process reveals API paths, internal domains, keys, and WebSocket endpoints not discoverable via traditional URL scanning.

What is the best way to find API endpoints in Vue, React, or Angular SPAs?▼

Finding API endpoints in Vue, React, or Angular SPAs requires dedicated JS bundle analysis. By examining the bundled JavaScript code, you can uncover hidden API paths, internal domains, and sensitive artifacts for subsequent penetration testing.

Can I use JS bundle analysis to extract API keys and internal domains?▼

Yes, JS bundle analysis extracts API keys and internal domains by analyzing JavaScript content and common patterns. It effectively reveals sensitive artifacts, internal domains, and WebSocket endpoints that traditional directory scanning misses in SPA architectures.

Does endpoint extraction work with Webpack bundles?▼

Endpoint extraction works with Webpack bundles by analyzing the compiled JavaScript content. It identifies common patterns within bundled files to reveal hidden API paths, keys, and WebSocket endpoints for Vue, React, and Angular SPA architectures.

What should I do after discovering API endpoints in a JS bundle?▼

After discovering API endpoints in a JS bundle, you should feed the extracted results into an API semantic fuzzing tool. This validates the endpoint behavior and supports comprehensive API penetration testing of the identified paths and domains.

Why are traditional URL scanners not finding API paths in my SPA?▼

Traditional URL scanners fail to find API paths in SPAs because the endpoints are hidden within compiled JavaScript bundles rather than exposed as direct links. Analyzing the JS bundle content is required to reveal these hidden API paths and internal domains.