skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

recon-js-analysis

Extract API endpoints, routing tables, and environment configurations from client-side JavaScript bundles.

Updated Jul 30, 2026
Search Tags:#javascript#reconnaissance#web-security#static-analysis#pentesting#api-discovery
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-js-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-js-analysis
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/recon-js-analysis
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-js-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates the discovery of hidden API endpoints, internal hostnames, and environment configurations buried within client-side JavaScript bundles, which are often overlooked during manual reconnaissance.

Core Features & Use Cases

  • Architectural Discovery: Automatically identifies framework routing tables (React, Vue, Angular, etc.) and API client configurations.
  • Secret & Config Mapping: Detects leaked environment variables, feature flags, and third-party service integrations (Stripe, Sentry, etc.).
  • Use Case: When auditing a modern Single Page Application, use this skill to map out the entire backend API surface and internal infrastructure naming conventions by analyzing the site's minified production JavaScript files.

Quick Start

Use the recon-js-analysis skill to scan the provided list of target URLs for API endpoints and internal configuration clues.

Frequently Asked Questions about recon-js-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract API endpoints from JavaScript bundles during web reconnaissance?▼

To extract API endpoints from JavaScript bundles, static analysis identifies routing tables and API client configurations within client-side code. This architectural discovery maps the backend API surface by passively collecting and scanning minified production JS assets.

What is static analysis of JavaScript bundles used for in pentesting?▼

Static analysis of JavaScript bundles is used for web application reconnaissance to uncover hidden API endpoints, internal hostnames, and leaked environment variables. It automates the discovery of architectural intelligence often overlooked during manual security assessments.

Can I detect leaked environment variables and secrets in minified JavaScript?▼

Yes, you can detect leaked environment variables and secrets in minified JavaScript. Static analysis maps leaked configuration data like feature flags and third-party service integrations, including Stripe and Sentry, by parsing client-side bundles.

How do I map routing tables for React or Vue applications during security assessments?▼

To map routing tables for React or Vue applications, static analysis identifies framework-specific routing configurations embedded in the JavaScript bundles. This reveals the application's client-side navigation structure and underlying API client setups.

Do I need scope-validated target URLs to perform JavaScript reconnaissance?▼

Yes, you need scope-validated target URLs to perform JavaScript reconnaissance. The static analysis process requires defined targets to execute passive HTTP-based collection of JavaScript assets securely and accurately during security assessments.

Related Skills

Explore More Software Engineering Skills→
ersinkocersinkoc
2

Web Application Fingerprinting

Identify website technologies via HTTP headers and HTML analysis.

Community
Intermediate
salmanabdurrahmansalmanabdurrahman

client-spa-endpoints

Extract API endpoints, hostnames, and routes from JavaScript bundles via static analysis.

Community
Advanced
G36maidG36maid
6

web-exploits

Identify and exploit common web vulnerabilities in capture-the-flag challenges.

Community
Intermediate
jinyimeng01jinyimeng01
54

passive-recon

Collect subdomains, certificate records, and historical URLs from public sources.

Community
Intermediate