skills.rest
Aradotso
AradotsoOFFICIAL
Explore all skills by this author →
Website𝕏@aradotsoGitHub

jsreverser-mcp-javascript-reverse-engineering

Reverse engineer obfuscated JavaScript by observing live browser behavior.

7|2|Updated May 16, 2026
Search Tags:#deobfuscation#browser debugging#network tracing#function hooking#api signature#javascript reverse engineering#runtime reconstruction
One-click install
npx skills add https://github.com/Aradotso/mcp-skills --skill jsreverser-mcp-javascript-reverse-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: jsreverser-mcp-javascript-reverse-engineering
Source: https://github.com/Aradotso/mcp-skills/tree/main/skills/jsreverser-mcp-javascript-reverse-engineering
Command: npx skills add https://github.com/Aradotso/mcp-skills --skill jsreverser-mcp-javascript-reverse-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you recover the real logic behind obfuscated or encrypted frontend JavaScript by observing, interrupting, and extracting runtime behavior directly in a real browser session.

Core Features & Use Cases

  • Script & Evidence Collection: Locate loaded scripts, retrieve their sources, and capture runtime evidence (scripts, network, hooks, and environment artifacts) for later reconstruction.
  • Function Hooking & Call Tracing: Hook target functions (including crypto-related calls), capture arguments/returns/stacks, and trace call chains to identify where key parameters are generated.
  • Breakpoints, Network Tracing & Deobfuscation: Use breakpoints and request tracing to correlate execution with outgoing traffic, then deobfuscate and understand the extracted code for API signature or request parameter logic.

Quick Start

Use the jsreverser-mcp-javascript-reverse-engineering skill to connect to a Chrome instance with remote debugging, navigate to the target page, then ask it to trace and deobfuscate how the site generates the encrypted or signed request parameters.

Frequently Asked Questions about jsreverser-mcp-javascript-reverse-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer obfuscated JavaScript that generates encrypted request parameters?▼

To reverse engineer obfuscated JavaScript, you hook target functions and set breakpoints in a live browser session to capture arguments, returns, and call stacks. This traces where encrypted request parameters are generated and exports evidence for local code reconstruction.

What is the best way to deobfuscate JavaScript and trace API signature generation in the browser?▼

The best way to deobfuscate JavaScript and trace API signatures is by using browser remote debugging to retrieve loaded scripts, hook crypto-related functions, and correlate breakpoints with network request initiators to understand the signature logic.

Can I hook crypto functions and capture call stacks to find where API signatures are generated?▼

Yes, you can hook crypto-related functions in a live browser to capture their arguments, return values, and call stacks. This function hooking identifies the exact code paths responsible for generating API signatures and other critical request parameters.

How do I trace network requests back to the JavaScript code that initiated them for security research?▼

You trace network requests by using request initiator tracing alongside breakpoints during a live browser debugging session. This correlates outgoing traffic with specific script execution, revealing the exact JavaScript logic producing signed or encrypted payloads.

Do I need Chrome remote debugging to intercept and deobfuscate frontend JavaScript?▼

Yes, Chrome remote debugging is required to connect to a live browser instance, navigate target pages, retrieve script sources, and execute the function hooking and breakpoint control needed to intercept and deobfuscate frontend JavaScript.

Why does deobfuscating JavaScript locally fail to reveal how encrypted API parameters are constructed?▼

Local static deobfuscation often fails because encrypted API parameters rely on runtime behavior and environment artifacts. Observing live browser execution through function hooking and network tracing captures the dynamic call chains needed for accurate reconstruction.

Related Skills

Explore More Software Engineering Skills→
xxihxxih
1

browser

Automate Chrome navigation, JavaScript execution, screenshots, and DOM selection via the Chrome DevTools Protocol on port 9222.

Community
Intermediate
rodydavisrodydavis
58

various-ways-to-invoke-functions-in-dart

Demonstrate Dart function invocation with positional, named, .call, and Function.apply.

Community
Basic
DexterJieDexterJie

ctf-malware

Analyze malware and network traffic in CTF challenges.

Community
Advanced
Quill-AgentQuill-Agent
3

scrapling

Automate web scraping with anti-bot bypass and JavaScript-rendered content.

Community
Advanced