Тёмная

JSInspector | НЕЙРО_ПЕНТЕСТ

Deep JavaScript Attack Surface Analyzer — Secrets, Endpoints, Internal Hosts

📖 How to Use / Как использовать
  1. URL Mode (🔗 URL / Ссылка) — enter any URL. JSInspector will fetch the page, find all linked JS files, then scan each one for secrets, API endpoints, internal hosts, SSRF parameters, and IDOR patterns.
  2. Code Mode (📄 Code / Код) — paste JavaScript code directly. Useful for analyzing harvested or deobfuscated scripts.
  3. 🔒 Secrets — finds AWS keys, API tokens, Bearer tokens, private keys, JWTs, passwords in JS code.
  4. 💩 Internal Hosts — finds internal IP addresses, private domains, cloud metadata endpoints (169.254.169.254).
  5. 🔗 API Endpoints — extracts internal API paths, path traversal vectors, debug endpoints.
  6. 🔓 IDOR Patterns — finds predictable IDs, sequential IDs, UUID patterns that may indicate authorization vulnerabilities.
  7. 🔗 LogicChainer — found a suspicious endpoint? Click 🔗 next to it to send it directly to LogicChainer for authorization testing.
  8. ⚠️ Test only sites you have permission to test

Analysis Mode / Режим анализа

Target URL to scan for JavaScript files
🔗
🔑 Secrets 🌐 Internal Hosts 🔗 API Endpoints ⚠ SSRF Params 🔓 IDOR Patterns 🐛 Debug Paths
JavaScript source code to analyze
</> </>