JS Analyzer - Burp Suite Extension by Jensec

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/jenish-sojitra/JSAnalyzer
• Blog Title: JS Analyzer - Burp Suite Extension by Jensec
• Suggested Section: Pentesting Web -> (new/sub)section: JavaScript Recon / Source Code Analysis (Burp extensions) or add under existing 'Pentesting Web Methodology' with a tool note for static JS endpoint/secret extraction

🎯 Content Summary

JS Analyzer (JSAnalyzer) — Burp Suite extension for static JavaScript recon
JS Analyzer is a Burp Suite extension (Python running under Burp’s Jython environment) that performs static analysis of JavaScript responses captured in Burp to extract security-relevant artifacts with aggressive noise filtering. It does not exploit a CVE directly; instead, it accelerates discovery of attack surface and leaked secrets that commonly lead to high-impact follow-on attacks (unauthori...

🔧 Technical Details

Trick 1 — Static JavaScript endpoint discovery: Capture JavaScript bundles/responses via an intercepting proxy (Burp) and regex-extract route-like strings (e.g., /api/v1/users, /graphql, /oauth2/token, /admin, /.well-known/openid-configuration) to expand the testable attack surface beyond what the UI reveals. Use the discovered endpoints as a prioritized wordlist for authorization testing, fuzzing, and functionality discovery.

Trick 2 — Client-side secret harvesting with format-aware patterns: Scan JavaScript for recognizable credential/token formats (e.g., AKIA[0-9A-Z]{16}, AIza[0-9A-Za-z\-_]{35}, sk_live_[0-9a-zA-Z]{24,}, ghp_[0-9a-zA-Z]{36}, xox[baprs]-..., eyJ..., -----BEGIN PRIVATE KEY-----, mongodb:///postgres:///mysql://). Validate discovered secrets against their ...

🤖 Agent Actions

Updated Pentesting Web Methodology spidering section with JS Analyzer Burp extension details (capabilities, noise filtering, installation/use workflow, headless engine example) and added a references section citing the tool’s repository. No tests were run (docs-only change).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/jenish-sojitra/JSAnalyzer

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> (new/sub)section: JavaScript Recon / Source Code Analysis (Burp extensions) or add under existing 'Pentesting Web Methodology' with a tool note for static JS endpoint/secret extraction".

Repository Maintenance:

• MD Files Formatting: 936 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0