js-attack-surface

What problem does it solve?

It removes the guesswork in bug bounty hunting by systematically collecting a target’s first-party JavaScript and turning key technical signals into a triaged lead list you can manually validate.

Core Features & Use Cases

• First-party JS discovery: Fetches JavaScript URLs from Wayback/Gau/Katana sources, deduplicates results, and filters out common CDN and third-party domains.
• Targeted signal extraction: Scans downloaded JS for realistic attack surface indicators such as API/endpoint routes, auth/token patterns, DOM XSS sinks, GraphQL query/mutation usage, hardcoded secret candidates, open redirect parameters, and postMessage handling.
• Lead-focused triage output: Applies trigger-path and impact checks so outputs stay as “confirmed-style leads” rather than noisy hypotheses.
• Use Case: When you’re investigating a web app and want to understand what client-side functionality might expose IDOR, XSS, auth weaknesses, or risky redirect behavior, without manually reading every file.

Quick Start

Ask the skill to analyze a URL you’re hunting for (for example, use the target domain as the argument) and it will print a triaged list of viable attack vectors based on first-party JS only.