JSRev 🔓

JavaScript Source Map Reverser — Extract original source code from .js.map files for security testing and bug bounty reconnaissance.

     ╦╔═╗╦═╗╔═╗╦  ╦
     ║╚═╗╠╦╝║╣ ╚╗╔╝
    ╚╝╚═╝╩╚═╚═╝ ╚╝

Install

npm install -g @fefortunato/jsrev

Usage

# Extract single source map
jsrev app.js.map -o ./extracted

# Scan directory for all .map files
jsrev -d ./js/ -o ./sources

# Recursive scan of target website dump
jsrev -d ./target.com/ -r -o ./sources

# Pipe from curl
curl -s https://target.com/app.js.map | jsrev - -o ./out

Options

| Option | Description | |--------|-------------| | -h, --help | Show help message | | -v, --version | Show version | | -o, --output <path> | Output directory (default: current) | | -d, --dir <path> | Scan directory for .map files | | -r, --recursive | Scan directories recursively | | -q, --quiet | Suppress banner and progress | | --sourceRoot <path> | Override sourceRoot field |

Why?

Developers sometimes accidentally deploy source maps to production. This tool helps security researchers:

1. Reconnaissance — Understand the application's internal structure
2. Code Review — Find vulnerabilities in the original source
3. Secret Discovery — Locate hardcoded API keys, endpoints, etc.

Example Output

[*] Scanning recursively for .map files in: ./target.com
[+] Found 5 source map file(s)
[*] Output directory: ./sources
──────────────────────────────────────────────────
[✓] main.js.map → 12 files extracted
[✓] vendor.js.map → 45 files extracted
[✓] polyfills.js.map → 3 files extracted
──────────────────────────────────────────────────
[*] Summary:
    ✓ Processed: 5/5 maps
    ✓ Extracted: 87 source files
    → Output: ./sources

License

MIT