Skip to content

GhostJS Burp Extension v1.1.0

Choose a tag to compare

View all tags
@yashhackzz yashhackzz released this 04 Sep 19:40
· 2 commits to main since this release
v1.1.0
6187aa6

GhostJS v1.1.0 — First Release 👻

A Burp Suite extension that passively scans JavaScript, HTML, and JSON responses for 150+ kinds of secrets and hidden API endpoints as you browse.

Install

  1. Download ghostjs.jar below.
  2. Go to Burp → Extensions → Installed → Add.
  3. Set Extension type: Java and select ghostjs.jar.
  4. A “GhostJS” tab will appear.
  5. Start browsing your target.

Highlights

  • 150+ secret patterns — AWS/GCP/Azure, Stripe, GitHub/GitLab, JWT, Firebase, Slack, private keys, DB URIs, and more.
  • API endpoint, cloud-storage, and source-map discovery
  • Active fetching of referenced JS bundles — replays your session cookies.
  • Low-noise false-positive filter — filters documentation samples and public-by-design keys.
  • Proxy highlighting + findings tab + Markdown export
  • Non-blocking architecture
  • JDK 17+ required only for building
  • Part of the TrinetLayer platform

TrinetLayer Platform

Web Scanner:
https://app.trinetlayer.com/

Validate any key in seconds:
https://validator.trinetlayer.com/

Requirements

Burp Suite — Community or Pro

Assets 3
Loading