What problem does it solve? Manual reconnaissance of modern web applications misses most of the real attack surface because SPA frontends lazy-load JavaScript chunks and hide API definitions behind client-side routing. This Skill automates deep JavaScript collection and analysis so that endpoint-to-parameter mappings, hardcoded credentials, and technology fingerprints are captured systematically instead of by ad-hoc browsing. ## Core Features & Use Cases - Dual-channel JS collection: Combines headless browser probing (browser_probe) with direct download of script tags and Wayback Machine historical JS, then reads every file to extract full request signatures (method, Content-Type, required/optional parameters, auth scheme). - Structured endpoint mapping: Produces _endpoint_params.json with completeness metadata (analysis_completeness ≥ 0.8, ≥3 endpoints) that gates progression to later testing phases. - Fingerprinting and CVE matching: Identifies frameworks, WAF/CDN vendors, and dependency versions, then maps them to known CVEs (Fastjson, Shiro, Log4j, Spring Actuator). - Source leak mining: Searches GitHub/Gitee organizations, commits, and issues for leaked credentials, with a defined workflow to re-inject found credentials after later phases complete. - Use Case: Given an authorized target URL, run the recon phase to download all JS bundles, click through SPA menus to trigger lazy chunks, and produce a complete API attack-surface map plus an initial leaked-value pool for downstream linkage testing. ## Quick Start Run the recon agent against the authorized target URL to collect all JavaScript files, extract API endpoints with their parameters, and generate the _endpoint_params.json attack-surface map.
