JS File Extractor — Burp Suite Extension

A Burp Suite extension that extracts JavaScript file URLs from your sitemap — either from a single page or recursively across an entire domain. Extracted URLs are saved to a file with ready-to-run curl, wget, and PowerShell download commands generated automatically.

---

Features

Feature	Description
Single-page extraction	Extract JS files from only the selected sitemap entries
Recursive domain crawl	Walk every HTML page under the target domain, following <a>, <script>, <link>, <form>, and <iframe> tags to surface all JS files site-wide
Clipboard support	Copy the URL list directly to your clipboard
Download commands	Saved files include auto-generated curl, wget, and PowerShell Invoke-WebRequest commands for every discovered URL
Scope-safe	Recursive mode stays within the target domain(s) — never crawls external hosts

---

How It Works

Normal Mode

Looks up the Burp sitemap for the host(s) of your selected entries and returns every URL whose response Content-Type includes javascript.

Recursive Mode (Domain Crawl)

1. Seeds a queue with all sitemap entries for the target domain(s).
2. For each entry in the queue:
   • HTML pages → parses <a href>, <script src>, <link href>, <form action>, <iframe src>, and any quoted https:// strings to discover new page links.
   • JS files → records the URL and mines the body for import, require, fetch, .src =, and path-like strings that may reference more JS.
3. New same-domain URLs are added to the queue.
4. Repeats until no new URLs are found.

Note: The crawl is entirely passive — it reads only pages already captured in Burp's sitemap. No new HTTP requests are made by the extension. For best coverage, browse or spider the target through Burp before running the extraction.

---

Output File Format

When saving to a file, the output is structured as follows:

https://target.com/static/app.js
https://target.com/static/vendor.js
https://target.com/lib/utils.js


# curl
curl -sSO "https://target.com/static/app.js"
curl -sSO "https://target.com/static/vendor.js"
curl -sSO "https://target.com/lib/utils.js"


# wget
wget -q "https://target.com/static/app.js"
wget -q "https://target.com/static/vendor.js"
wget -q "https://target.com/lib/utils.js"


# PowerShell (Invoke-WebRequest)
Invoke-WebRequest -Uri "https://target.com/static/app.js" -OutFile "app.js"
Invoke-WebRequest -Uri "https://target.com/static/vendor.js" -OutFile "vendor.js"
Invoke-WebRequest -Uri "https://target.com/lib/utils.js" -OutFile "utils.js"

---

Installation

1. Download Jython

Download the latest standalone Jython JAR from the Jython website.

2. Configure Jython in Burp Suite

1. Open Burp Suite.
2. Go to Extensions → Extension Settings.
3. Under Python Environment, click Select file and point it to the Jython JAR.

3. Load the Extension

1. Go to Extensions → Installed → Add.
2. Set Extension type to Python.
3. Click Select file and choose jsextractor.py.
4. Click Next / Finish.

---

Usage

1. Browse the target through Burp to populate the sitemap (use the built-in crawler or browse manually with Intercept on).

2. Select sitemap entries:

   • Go to Target → Site map.
   • Select one or more items from the domain you want to extract JS from.

3. Right-click the selection and choose one of four options:

   Menu Item	Behaviour
   Extract JS Files to File	Saves JS URLs + download commands to a file (current sitemap only)
   Copy JS Files to Clipboard	Copies JS URLs to clipboard (current sitemap only)
   Extract JS Files to File (Recursive)	Crawls all pages in the domain, saves URLs + download commands
   Copy JS Files to Clipboard (Recursive)	Crawls all pages in the domain, copies URLs to clipboard

---

Contributing

Contributions are welcome. Fork the repository and open a pull request with your changes.

License

MIT License — see LICENSE for details.