skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

js-secrets-extraction

Detect hardcoded credentials and internal endpoints in JavaScript bundles and source maps.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration-testing#web-recon#secret-scanning#red-teaming#js-secrets#api-key-extraction#source-map-analysis
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill js-secrets-extraction
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: js-secrets-extraction
Source: https://github.com/uphiago/recon-skills/tree/main/recon/js-secrets-extraction
Command: npx skills add https://github.com/uphiago/recon-skills --skill js-secrets-extraction

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) components.

What problem does it solve?

This Skill eliminates the manual effort of identifying hardcoded secrets, internal API endpoints, and sensitive configuration data hidden in modern JavaScript bundles and source maps that are often exposed during web reconnaissance, which would be easily missed by manual review or standard directory scanning.

Core Features & Use Cases

  • Automated Secret Scanning: Detects 11+ common secret patterns including API keys, JWTs, AWS access keys, Firebase/Supabase configs, Stripe keys, and internal IP addresses in JS bundles.
  • Source Map Reconstruction: Recovers original uncompiled source code from exposed .js.map files to uncover additional embedded credentials and internal application logic.
  • Use Case: During a penetration test of a healthcare SaaS platform, use this skill to scan the admin portal's JS bundle (hosted on a non-standard port 8080) to find a leaked backend API URL and authentication secrets that bypass the public CDN and WAF.

Quick Start

Use the js-secrets-extraction skill to scan all JavaScript bundles on the target's main website and admin portals for hardcoded secrets, API keys, and internal endpoints.

Frequently Asked Questions about js-secrets-extraction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract hardcoded secrets from JavaScript bundles during a penetration test?▼

Source map reconstruction recovers original uncompiled source code from exposed .js.map files, revealing embedded credentials and internal application logic that are missed during standard compiled bundle scanning.

Can I scan JavaScript files hosted on non-standard ports for internal API endpoints?▼

The tool detects 11+ common secret patterns including AWS access keys, Firebase configs, Stripe keys, JWTs, and internal IP addresses within compiled JavaScript assets and source map files.

What is the best way to find leaked credentials in exposed source map files?▼

This approach is designed for penetration testing, red teaming, and vulnerability assessment workflows targeting modern single-page applications, admin portals, and cloud-hosted web services with publicly accessible JS assets.

Does this automated secret scanning approach work for batch processing local JS files?▼

Yes, automated secret scanning supports batch processing of both local and remote JS files, applying regex-based pattern matching to efficiently identify hardcoded credentials across multiple JavaScript assets.

Related Skills

Explore More Software Engineering Skills→
geezerrrrgeezerrrr
117

summarize

Summarize web pages, podcasts, YouTube transcripts, and local files via CLI with multiple providers and models.

Community
Intermediate
uphiagouphiago
1.1k

google-dorks-catalog

Identify exposed configuration files and credentials using pre-validated Google dork queries.

Community
Intermediate
uphiagouphiago
1.1k

web-enumeration

Scan web servers for exposed sensitive files and hidden endpoints.

Community
Advanced
armanzeroeightarmanzeroeight
29

secrets-detector

Detect hardcoded secrets and API keys in source code repositories.

Community
Intermediate