skills.rest
cuongnguyen-git
cuongnguyen-gitCOMMUNITY
Explore all skills by this author →
GitHub

js-attack-surface

Collect and analyze first-party JavaScript to identify client-side attack vectors.

Updated May 14, 2026
Search Tags:#xss#javascript#graphql#attack surface#idor#recon#open redirect
One-click install
npx skills add https://github.com/cuongnguyen-git/bug-bounty --skill js-attack-surface
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: js-attack-surface
Source: https://github.com/cuongnguyen-git/bug-bounty/tree/main/.claude/skills/js-attack-surface
Command: npx skills add https://github.com/cuongnguyen-git/bug-bounty --skill js-attack-surface

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It removes the guesswork in bug bounty hunting by systematically collecting a target’s first-party JavaScript and turning key technical signals into a triaged lead list you can manually validate.

Core Features & Use Cases

  • First-party JS discovery: Fetches JavaScript URLs from Wayback/Gau/Katana sources, deduplicates results, and filters out common CDN and third-party domains.
  • Targeted signal extraction: Scans downloaded JS for realistic attack surface indicators such as API/endpoint routes, auth/token patterns, DOM XSS sinks, GraphQL query/mutation usage, hardcoded secret candidates, open redirect parameters, and postMessage handling.
  • Lead-focused triage output: Applies trigger-path and impact checks so outputs stay as “confirmed-style leads” rather than noisy hypotheses.
  • Use Case: When you’re investigating a web app and want to understand what client-side functionality might expose IDOR, XSS, auth weaknesses, or risky redirect behavior, without manually reading every file.

Quick Start

Ask the skill to analyze a URL you’re hunting for (for example, use the target domain as the argument) and it will print a triaged list of viable attack vectors based on first-party JS only.

Frequently Asked Questions about js-attack-surface

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find client-side attack surface from first-party JavaScript files?▼

To find client-side attack surface from first-party JavaScript, you can collect and analyze JS files to extract endpoint routes, DOM XSS sinks, GraphQL usage, hardcoded secrets, and postMessage handlers. This process filters out third-party domains to focus on realistic vulnerabilities.

What is the best way to discover IDOR and open redirect vulnerabilities in web app JavaScript?▼

The best way to discover IDOR and open redirect vulnerabilities in JavaScript is to download first-party JS files and scan them for specific regex-based signals. This identifies API endpoint routes, auth token patterns, and redirect parameters for manual triage.

How does JavaScript reconnaissance identify DOM XSS sinks and postMessage risks?▼

JavaScript reconnaissance identifies DOM XSS sinks and postMessage risks by applying targeted regex extraction to downloaded JS files. It scans for user-controlled trigger paths and impact signals, outputting a triaged lead list for manual validation.

Can I automate bug bounty recon to extract API endpoints and GraphQL queries from target JS?▼

Yes, you can automate bug bounty recon to extract API endpoints and GraphQL queries from target JS. By fetching JavaScript URLs from sources like Wayback, Gau, or Katana, the process deduplicates results and extracts specific attack surface indicators.

Does this JavaScript attack surface analysis require a specific environment like Kali WSL?▼

Yes, this JavaScript attack surface analysis requires executing JS URL discovery tools and downloading JS into a working directory in Kali WSL. This environment supports the necessary reconnaissance tools and local file analysis.

Why should I filter out third-party CDN domains during JavaScript attack surface mapping?▼

Filtering out third-party CDN domains during JavaScript attack surface mapping ensures you only analyze first-party JS. This removes noisy hypotheses and focuses triage on realistic client-side attack vectors the target organization actually controls.

Related Skills

Explore More Software Engineering Skills→
Steffen025Steffen025
186

WebAssessment

Integrate reconnaissance, threat modeling, and vulnerability testing for web applications.

Community
Advanced
mahamaneharouna9-cpumahamaneharouna9-cpu

web-security-expert

Identify and test web application vulnerabilities including OWASP Top 10 risks.

Community
Intermediate
waltstephenwaltstephen

setup-and-running-in-wsl

Run and verify a static HTML/CSS/JS project in WSL with a local HTTP server.

Community
Intermediate
allsmogallsmog
22

DOM XSS via postMessage

Detects DOM XSS vulnerabilities from insecure postMessage usage in JavaScript and TypeScript codebases.

Community
Intermediate