✎ The Anatomy of Source Maps and Reconstructing Original Source Code

A source map is a .map file that links transformed code back to the original source, allowing browsers to display the original code in debuggers. For bug hunters, this is valuable because it makes reading code easier, reveals developer comments and ... .

Browsers use source maps to reconstruct original code automatically. Similarly, you can use tools like Sourcemapper to retrieve a website’s original source if the .map files are publicly accessible.

sourcemapper -output dhubsrc -url https://target.com/js/client.356c1491.js.map

 
References
• Introduction to JavaScript Source Maps
• Source maps: languages, tools
• Extracting JavaScript from Sourcemaps

#bugbounty #sourcemap #javascript
© t.iss.one/BugBounty_Diary

✎ Extract URL Paths or Routes via Dev Tools

[...new Set([...document.querySelectorAll("a[href]")].map(a => new URL(a.href, location.href).pathname))]
.forEach(path => console.log(path));

• Save and download a .txt file with all those paths:

(() => {
    const paths = [...new Set([...document.querySelectorAll("a[href]")].map(a => new URL(a.href, location.href).pathname))];
    
    const blob = new Blob([paths.join("\n")], { type: "text/plain" });
    const a = document.createElement("a");
    a.href = URL.createObjectURL(blob);
    
    const domain = location.hostname.replace(/^www\./, ""); 
    a.download = `${domain}.txt`;
    
    document.body.appendChild(a);
    a.click();
    document.body.removeChild(a);
})();

#bugbounty #devtool #javascript
© t.iss.one/BugBounty_Diary

✎ Deobfuscate obfuscator.io, unminify, transpile, and unpack webpack/browserify, using webcrack to resemble the original source code as much as possible.

Command Line Interface

npm install -g webcrack

Examples

webcrack input.js
webcrack input.js > output.js
webcrack bundle.js -o output-dir

• Repository: Github
• Website: webcrack.netlify.app

#bugbounty #recon #javascript #deobfuscate
© t.iss.one/BugBounty_Diary

✎Grep tips for Javascript Analysis

• Extracting JavaScript Files from recursive Directories

find /path/to/your/folders -name "*.js" -exec mv {} /path/to/target/folder/ \;

• Searching for API Keys and Secrets

cat * | grep -rE "apikey|api_key|secret|token|password|auth|key|pass|user"

• Detecting Dangerous Function Calls

cat * | grep -rE "eval|document\.write|innerHTML|setTimeout|setInterval|Function"

• Checking for URL Manipulation

cat * | grep -rE "location\.href|location\.replace|location\.assign|window\.open"

• Searching for Cross-Origin Requests

cat * | grep -rE "XMLHttpRequest|fetch|Access-Control-Allow-Origin|withCredentials" /path/to/js/files

• Analyzing postMessage Usage

cat * | grep -r "postMessage"

• Finding Hardcoded URLs or Endpoints

cat * | grep -rE "https?://|www\."

• Locating Debugging Information

cat * | grep -rE "console\.log|debugger|alert|console\.dir"

• Investigating User Input Handling

cat * | grep -rE "document\.getElementById|document\.getElementsByClassName|document\.querySelector|document\.forms"

#bugbounty #recon #javascript
© t.iss.one/BugBounty_Diary

✎ Burp Extension for API Testing in JS-Rich Targets

This tool helps identify endpoints, files, internal emails, and some secrets hidden in minified JavaScript, achieving maximum efficiency while minimizing noise in the results.

• Repository: Github

#bugbounty #recon #javascript #burp
© t.iss.one/BugBounty_Diary