🔒 JSRecon

AST-based JavaScript Attack Surface Mapper

Unlike regex scrapers, JSRecon parses the Abstract Syntax Tree to understand how code actually runs — not just how it looks.

---

⚡ Why JSRecon?

Regex-based tools (LinkFinder, etc.) produce noise. JSRecon builds a real AST (esprima) and resolves:

Capability	How
Endpoint extraction	fetch, axios.*, XMLHttpRequest.open, $.ajax, config objects — with constant folding (const API='/v2'; axios.post(API+'/login') → /v2/login)
IDOR signals	Template literals `/users/${userId}` → dynamic params scored as IDOR candidates
Secrets engine	20+ signatures (AWS/GitHub/Stripe/Slack/Google/JWT) + Shannon entropy analysis
Sourcemap recovery	Probes *.js.map → extracts original unminified sources for deeper analysis
Passive checks	Security headers, cookie flags (HttpOnly/Secure/SameSite), CORS reflection, S3/GCS/Azure references
Validation	Opt-in same-origin probing (GET/OPTIONS only, rate-limited) — confirms live endpoints
Reports	Self-contained dark-theme HTML · JSON · CSV · Burp Suite sitemap XML

---

🎥 Demo

Animated version: demo.cast — play with asciinema play demo.cast

---

🚀 Quick Start

# Install
pip install -e .

# Scan a target you own / are authorized to test
jsrecon scan https://your-app.com --validate -o report.html

# Deeper crawl + Burp export
jsrecon scan https://your-app.com -p 10 --validate --rate 1.0 --burp sitemap.xml

---

📊 Output

Terminals get rich color output; reports are self-contained dark-theme HTML with risk-ranked endpoints, redacted secret findings, and misconfiguration checks.

---

🏗️ Architecture

graph LR
    A[Target] --> B[Crawler<br>httpx+asyncio]
    B --> C[JS Fetcher]
    C --> D[AST Parser<br>esprima]
    D --> E[Classifier<br>Risk Scoring]
    D --> F[Secrets Engine<br>Entropy + Signatures]
    E --> G[Validator<br>Optional]
    G --> H[Reporter<br>HTML/JSON/CSV/Burp XML]
    F --> H

Loading

---

📦 Install Options

# From source
git clone https://github.com/viveksec/jsrecon.git
cd jsrecon
pip install -e .

# With dev tools (tests)
pip install -e ".[dev]"
pytest tests/ -q

---

🧪 Tests

pytest tests/ -q
# 30/30 passing — extractor, secrets, classifier, checks, reporter

---

⚠️ Legal & Responsible Use

This tool is for authorized security testing only. Use only on systems you own or have explicit written permission to test. Misuse of this tool is the sole responsibility of the user.

---

👤 Author

Vivek — github.com/viveksec

---

📄 License

MIT — see LICENSE