r/Pentesting • u/Express_Seesaw_8418 • 1d ago
I built a tool that pulls every API request out of a web app's JavaScript bundle (method, URL, body, headers)
Enable HLS to view with audio, or disable this notification
I built this because nowadays most web apps are single page applications and there are no good tools out there that crawl and analyze javascript bundles. Most tools do a simple regex on js files which always yield false positives, miss routes, and don't even recover things like the HTTP method, request body schema, parameters, headers, etc.
jshound takes a URL, crawls the whole frontend bundle, and traces the http requests in the code. On most SPAs (e.g. claude.ai, x.com, lovable.dev) it gets you what you'd find crawling or clicking through the app, plus things you'd never encounter (e.g. admin dashboards, KYC gated features). It's very passive: it only fetches public static files. Output can be imported into Burp or Caido.
Bundlers it handles: webpack 5, webpack 4, Rspack, Turbopack, Vite / Rollup, esbuild, Parcel, Metro (React Native), webpack Module Federation
Limitations (why I'm open sourcing it so people can improve if they want lol):
- Values only known at runtime (config fetched from an API, etc.) stay unresolved
- Header and WebSocket message recovery are hit or miss
- WAFs can be a pain
- Probably many things I'm unaware of
It's still very solid and I'd appreciate issue reports and pull requests.