Note

v1.1.0 is available — cross-browser (Chrome + Firefox) builds are attached to the release as zip/xpi packages.

JS Recon Extractor

JS Recon Extractor is a passive browser extension for authorized security testing.
It inspects the JavaScript already loaded on a page and surfaces API endpoints, URLs, subdomains, and likely-secret material — keys, tokens, JWTs, webhooks — before you ever write a single request.

Everything runs locally. No data leaves your machine.

---

Tip

AI agents and LLMs: the shortest way to understand this project is the README and the tests/ folder — the test suite documents every detection pattern with runnable assertions (node tests/patterns.test.js).

Table of Contents

• What is JS Recon Extractor?
• JS Recon Extractor in Action
• Quick Start
• Key Capabilities
• Editions
• Architecture
• Documentation
• Safety, Scope, and Limitations
• License
• About
• Community and Support

What is JS Recon Extractor?

JS Recon Extractor is a passive, client-side recon tool built as a browser extension (Manifest V3). JavaScript in modern web apps routinely embeds configuration, endpoint paths, internal hostnames, and — all too often — misconfigured credentials. This extension reads what the page has already loaded, normalizes the findings, and presents them in an in-page panel or as exportable reports.

It combines three capabilities into one workflow:

• Collection — scans inline <script> blocks and every external script, including scripts removed from the DOM after load and source maps (//# sourceMappingURL=), which frequently leak internal paths and endpoints.
• Analysis — extracts API endpoints, URLs (absolute, protocol-relative, bare-host), same-scope subdomains, and 20+ secret patterns with per-item severity.
• Triage — flags high-risk endpoints/subdomains (admin, debug, internal, staging, swagger, token, …) and supports on-demand, read-only secret verification against vendor identity endpoints.

Why It Exists

Passive recon is the fastest, safest way to map an application's attack surface. Instead of crawling or brute-forcing paths, you read the routes, hosts, and secrets the application itself hands to the browser. For bug-bounty hunting and pre-deployment checks, this turns "where do I start?" into a prioritized list in seconds.

JS Recon Extractor in Action

Example of the in-page panel output after visiting a page:

┌─ JS Recon Extractor ────────────────────────────────┐
│ 🔎 Filter results...                                │
│ All(4)  Critical(1)  High(1)  Medium(1)  Info(1)    │
│ ── Secrets (2) ──────────────────────────────────── │
│ [CRITICAL] Discord Webhook                          │
│   https://discord.com/api/webhooks/12345/…          │
│   [Verify live] [Copy]  ✓ LIVE / VALID             │
│ [HIGH] GitHub Token                                 │
│   ghp_…                                             │
│   [Verify live] [Copy]                              │
│ ── High-risk endpoints (1) ──────────────────────── │
│ /admin/panel                                        │
│ ── Endpoints (2) ────────────────────────────────── │
│ /api/v2/users?id=1                                  │
└─────────────────────────────────────────────────────┘

Exports are available as JSON, TXT, and Markdown, plus copy-to-clipboard for individual findings.

Quick Start

Prerequisites

• Google Chrome or Mozilla Firefox (Manifest V3 support).
• Nothing else — no build step, no dependencies. The extension is plain JS.

Install on Chrome

# 1. Open chrome://extensions
# 2. Enable Developer mode (top right)
# 3. Click "Load unpacked" and select the chrome/ folder

Install on Firefox

# 1. Open about:debugging
# 2. Click "Load Temporary Add-On"
# 3. Select firefox/manifest.json (or the .xpi from the release)

Warning

This extension performs passive analysis only, but the secrets it finds are real. Only use it against applications and environments you own or have explicit written authorization to test. Do not verify or use live credentials against targets outside your scope.

First scan

1. Open any page.
2. The floating pill at the bottom-right shows the finding count.
3. Click the pill to open the panel; use the search box and severity chips to filter.
4. Export findings via JSON / TXT / MD or click a value to copy it.

Key Capabilities

• Passive by design: reads only what the page already loaded; no crawling, no state-changing requests.
• Source-map mining: follows //# sourceMappingURL= (URL or inline base64) and analyzes .map sources / sourcesContent, revealing internal paths and endpoints.
• SPA-aware: re-scans on pushState navigation and when new <script> tags are injected (MutationObserver), so results stay fresh on React/Vue/Next apps.
• Persistence: findings are stored per host in chrome.storage.local and survive reloads, accumulating across pages of the same application.
• Secret detection: 20+ patterns — private keys, Discord webhooks, AWS, GitHub, Slack, Stripe, OpenAI, Anthropic, Google OAuth secrets, Telegram, SendGrid, npm, Twilio, JWTs, generic key assignments — each with a severity.
• On-demand verification: manual, read-only checks against the vendor's own identity endpoints (GitHub, Slack, Stripe, Mailgun, Discord, Telegram, OpenAI). Never automatic. JWT entries decode in place.
• High-risk triage: endpoints/subdomains matching triage keywords are surfaced in a dedicated section.
• Safety limits: 5 MB per-file cap, 15 s timeouts, and per-category result caps keep scanning sane on heavy pages.
• Scope configuration: add root domains via the options page to widen subdomain collection beyond the current page's host.

Editions

The project ships two builds from a single cross-browser codebase. The JavaScript is identical — a small browser alias makes the same files work under both the Firefox browser.* and Chrome chrome.* namespaces. Only the manifest.json differs.

Aspect	Chrome build (chrome/)	Firefox build (firefox/)
Background	service_worker	scripts (event page)
Manifest extras	minimum_chrome_version	browser_specific_settings.gecko (id, strict_min_version 121)
Install	chrome://extensions → Load unpacked	about:debugging → Load Temporary Add-On
Package	js-recon-extractor-chrome-1.1.0.zip	js-recon-extractor-firefox-1.1.0.xpi / .zip
Signing	Optional (Chrome Web Store)	Required for permanent install (addons.mozilla.org)

Architecture

The pipeline is a single-pass scan that runs in the content script, with the background worker handling fetches and verification:

        ┌──────────────────────────┐
        │   Collect script sources │
        │  (inline + external +    │
        │   performance entries)   │
        └──────────┬───────────────┘
                   │
                   ▼
        ┌──────────────────────────┐
        │   Source map mining      │
        │  (follow sourceMapping   │
        │   URLs, parse .map)      │
        └──────────┬───────────────┘
                   │
                   ▼
        ┌──────────────────────────┐
        │      Analysis            │
        │  endpoints / urls /      │
        │  subdomains / secrets    │
        └──────────┬───────────────┘
                   │
                   ▼
        ┌──────────────────────────┐
        │   Triage + dedup         │
        │  (severity, risk flags,  │
        │   caps)                  │
        └──────────┬───────────────┘
                   │
                   ▼
        ┌──────────────────────────┐
        │  Render + persist        │
        │  panel / badge / storage │
        └──────────────────────────┘

At a high level:

• Collection gathers live <script> tags plus resources already fetched (via performance.getEntries), so nothing is missed.
• Source map mining extends the analysis surface by pulling sources and sourcesContent from .map files.
• Analysis runs the shared pattern engine from patterns.js (also used by the Node test suite).
• Triage & dedup order secrets by severity, flag high-risk items, and enforce per-category caps.
• Render & persist update the badge/panel and store findings per host.

Fetches and secret verification run in the background worker, keeping the page thread free.

Documentation

Guide	Use it for
README	Overview, install, capabilities, architecture.
License	All-rights-reserved terms for the code.
Code of Conduct	Community expectations for issues and discussions.
tests/patterns.test.js	Runnnable assertions for every detection pattern (node tests/patterns.test.js).

Safety, Scope, and Limitations

JS Recon Extractor is not an active scanner. It does not issue requests beyond what the page itself has already made, and its only outbound calls are optional, user-triggered verification checks against vendor identity endpoints. That said:

• The secrets it surfaces are real. Treat any confirmed credential as a critical finding: stop, notify the owner, and never use it outside the target's scope.
• Automated secret scanning is intrusive. Only run this against assets you own or are explicitly authorized to test.
• Detection is regex-based; expect false positives (for example, Google browser API keys are commonly designed to be client-exposed and restricted by referrer/quota — check restrictions before reporting).
• Source-map mining can be chatty on large bundles; per-file and per-category caps prevent runaway memory.

Read the README legal note before using this tool in a new environment.

License

All rights reserved. This project is © 2026 JOJIN JOHN and may not be copied, modified, distributed, or reused in whole or in part without the author's prior written permission.

See LICENSE for the full terms.

About

JOJIN JOHN is the developer behind JS Recon Extractor. This extension is built for authorized security research and bug-bounty reconnaissance.

Community and Support

Issues and feature requests are welcome on GitHub:

• Report a bug
• Download releases

Please read the Code of Conduct before participating. All interactions in issues and discussions are expected to be respectful and constructive.

Built by JOJIN JOHN