How To approach recon on real targets — from passive enumeration to origin IP discovery. Covers tools, automation, and the logic behind each phase.
Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI.
Name analyzer written in Javascript
Agent skill for reverse-engineering undocumented website APIs with Chrome CDP, curl, and JS bundle analysis.
🤖 LLM-powered agent for automated JS analysis in bug hunting & pentesting.
Automated, program-aware bug bounty reconnaissance pipeline utilizing a centralized SQLite database, parallelized execution, continuous JavaScript monitoring, and interactive HTML reporting.
Passive client-side exposure analysis platform for detecting leaked secrets, risky frontend configs, and security-relevant JavaScript patterns.
JavaScript Intelligence Engine - SPA bundle'larindan secret/endpoint/source-map cikartan tek dosya ofansif recon araci. 63 secret regex'i, Source Map V3 dekoderi, webpack chunk parser, multi-format cikti. Bug bounty + self-audit.
Security Assistant Researcher Analyzer
A Python-powered reconnaissance tool that hunts exposed secrets, leaked credentials, and sensitive endpoints in web applications.
LinkRippr is a static analysis tool for HTML files. It can be used to extract elements from a DOM, as well as signatures from script and style elements, so that they can be analyzed in a formatted summary, rather than attempting to eyeball a large messy HTML file.
NearPath is a lightweight, guided fuzzing tool designed to discover hidden web application endpoints by combining shallow crawling, JavaScript mining, and heuristic path mutation.
Parse, explore, and analyze IBM Business Automation Workflow (BAW) TWX applications with dependency mapping and actionable script findings.
Fast Frontend JS Static Reconnaissance & Secret/Endpoint Hunter CLI
MELTOR is an all-in-one API endpoint discovery and validation engine designed for security researchers, penetration testers, and developers. It combines a high-performance web crawler, a JavaScript AST parser, an intelligent fuzzer, and a concurrent endpoint validator into a single powerful tool.
Open-source web asset scanner and JavaScript bundle analyzer. Inspect HTML/CSS/JS, explore bundles with Webcrack, and use MCP locally.
A highly automated and modular bug bounty reconnaissance toolkit integrating over 15 industry-standard tools for streamlined subdomain enumeration, vulnerability detection, and OSINT gathering. Designed for efficiency, scalability, and precision in real-world security assessments.
JScope is a JavaScript analysis and deobfuscation tool designed to help security researchers inspect client-side code, uncover suspicious patterns, and streamline bug bounty reconnaissance. Built for practical web security research, with a focus on understanding JavaScript rather than just cleaning it up. Currently in beta.
Local reverse-engineering toolkit for AI agents and the terminal, with a unified CLI and MCP server. Inspect native binaries, JavaScript/Electron apps, .NET assemblies, Android APKs, and browser/runtime behavior using Hopper, Ghidra, IDA, and other providers, with evidence and provenance.
Chrome extension to find vulnerabilities in JavaScript files. Scan live tabs, upload URL lists, or paste/upload single JS files for quick assessment.
To associate your repository with the javascript-analysis topic, visit your repo's landing page and select "manage topics."