JS Recon

A powerful tool for JavaScript reconnaissance. js-recon helps you discover, download, and analyze JavaScript files to uncover endpoints, secrets, and other valuable information from any web application running supported frameworks.

It can also reconstruct HTTP requests that the app makes to the server, and output them to the OpenAPI spec.

Installation

Homebrew (macOS and Linux)

brew tap js-recon/tap
brew install js-recon

This always installs the latest stable release. For the latest alpha or beta prerelease instead:

brew install js-recon/tap/js-recon-alpha
brew install js-recon/tap/js-recon-beta

To update:

brew update && brew upgrade js-recon

Note: If you installed JS Recon before the move to the js-recon GitHub organization, you may still have the old shriyanss/tap tapped locally. Since that repo was renamed (not deleted), Homebrew still resolves it, leaving two taps that both serve a formula named js-recon — causing errors like Formulae found in multiple taps or Refusing to load formula ... from untrusted tap .... Fix with brew untap shriyanss/tap before installing from js-recon/tap.

Note: After installing via Homebrew, the lazyload subcommand requires a Chromium browser. Run brew info js-recon for setup instructions.

npm (all platforms)

This tool requires Node.JS and npm to be installed. The official download page can be referred. Please install 22.17.0 (LTS) or later. Downloading older versions might break the tool.

To install the tool globally, run:

npm i -g @js-recon/js-recon

For detailed installation and setup process, please refer to the Installation page

Framework Support

The features in JS Recon tool are built after thorough research on apps running different frameworks.

Full pipeline support (lazyload → map → analyze → report) is available for: Next.js, Vue.js, Nuxt.js, React, Svelte/Astro, and Angular (v17+ / esbuild).

Please refer to the Framework Support page for detailed information on feature compatibility across different frameworks.

Quick Start

# Get a list of all commands
js-recon --help

# Get help for a specific command
js-recon <command> --help

To launch a quick assesment against a target, the run module can be used to automate other modules

js-recon run -u https://app.example.com

Commands

js-recon provides a suite of commands for comprehensive JavaScript analysis. For detailed usage and examples, please refer to its full documentation.

| Command | Description | Documentation | | ------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------- | | lazyload | Downloads dynamically loaded JavaScript files from a target. | Read Docs | | endpoints | Extracts API endpoints and client-side paths from JS files. | Read Docs | | strings | Extracts strings, URLs, and potential secrets from JS files. | Read Docs | | map | Maps function calls and analyzes code, with optional AI-powered descriptions. | Read Docs | | proxy | Routes requests through AWS API Gateway, SOCKS5/HTTP, or Oxylabs proxies. | Read Docs | | run | Runs all analysis modules automatically on a target. | Read Docs | | analyze | Analyzes the code. | Read Docs | | report | Generates a report from the analysis modules. | Read Docs | | mcp | AI-powered interactive CLI, one-shot chat, and MCP stdio server. | Read Docs | | fingerprint | Detects the JavaScript framework used by a target URL (JSON/JSONL output). | Read Docs | | refactor | Recovers readable JSX and strips library code from React (webpack/Vite) bundles. | Read Docs | | load | Populates the response cache from a Caido or Burp Suite export. | Read Docs | | cs-mast | Computes CS-MAST structural hashes for JS files and finds hash collisions. | Read Docs | | sourcemaps | Extracts original source files from .map sourcemap files. | Read Docs | | completion | Generates shell completion scripts for bash, zsh, or fish. | Read Docs |

Key Features

• Downloads all dynamically loaded JS files (refered as lazyload) from website with supported frameworks
• Use API gateway to rotate IP addresses to bypass firewall
• Extract strings from the discovered JS files, and extract potential secrets, endpoints, etc. from them (built-in scanner via --secrets; TruffleHog integration via --trufflehog)
• Endpoints modules extracts client-side paths from the app
• Map feature analyzes the JS files and outputs it to a JSON file. An interactive mode can be then used to analyze it
• Reconstruct HTTP requests that the app makes to the server, and output them to the OpenAPI spec
• Run analyze to find potential issues in JS code and the HTTP requests the app makes
• Generate a report from the analyze module

Example Scenario

Refer to this page where an example scenario of running this tool against a Next.JS target is demonstrated.

Documentation

For detailed guides, command options, and advanced usage examples, please check out the JS Recon Site at https://js-recon.io

Labs

Labs to test JS Recon tool are available in the JS Recon Labs repository. Labs walkthroughs are also available.

Contributing

Please refer to the Contributing page for detailed information on contributing to this project.

License

JS Recon is licensed under the MIT License - see the LICENSE file for details.