Unmapper

JavaScript Source Map Reverser — Extract original source code from .js.map files for security testing and bug bounty reconnaissance.

  ╦ ╦╔╗╔╔╦╗╔═╗╔═╗╔═╗╔═╗╦═╗
  ║ ║║║║║║║╠═╣╠═╝╠═╝║╣ ╠╦╝
  ╚═╝╝╚╝╩ ╩╩ ╩╩  ╩  ╚═╝╩╚═

Install

npm install -g unmapper

Features

| Feature | Description | |---------|-------------| | Local File Extraction | Extract from local .map files | | Directory Scanning | Process all .map files in a directory | | Remote URL Fetch | Download and extract from remote .map URLs | | JS Probing | Probe .js files to find and extract their source maps | | Page Spider | Spider HTML pages to find all scripts with source maps | | Colored Output | Visual status indicators with ANSI colors |

Usage

Local Files

# Extract from local file
unmapper app.js.map -o ./extracted

# Scan directory for all .map files
unmapper -s ./js/ -o ./sources

# Deep scan (recursive)
unmapper -s ./target/ -D -o ./sources

Remote URLs

# Fetch and extract from .map URL directly
unmapper -u https://target.com/app.js.map -o ./out

# Probe a .js file for its source map
unmapper -P https://target.com/bundle.js -o ./out

# Spider a page and find all source maps
unmapper -S https://target.com/ -o ./out

Options

Local Options

| Option | Description | |--------|-------------| | -s, --scan <path> | Scan directory for .map files | | -D, --deep | Scan directories recursively |

Remote Options

| Option | Description | |--------|-------------| | -u, --url <url> | Fetch and extract from .map URL directly | | -P, --probe <url> | Probe a .js URL for its source map | | -S, --spider <url> | Spider HTML page for all scripts |

General Options

| Option | Description | |--------|-------------| | -h, --help | Show help message | | -V, --version | Show version | | -o, --out <path> | Output directory (default: current) | | -q, --silent | Suppress banner and progress | | -p, --prefix <path> | Override sourceRoot field |

How It Works

Probe Mode (-P)

1. Fetches the JavaScript file
2. Looks for //# sourceMappingURL= comment
3. Falls back to common patterns (app.js → app.js.map)
4. Downloads and extracts the source map

Spider Mode (-S)

1. Fetches the HTML page
2. Extracts all <script src="..."> tags
3. Probes each script for source maps
4. Extracts all found source maps

Example Output

  ╦ ╦╔╗╔╔╦╗╔═╗╔═╗╔═╗╔═╗╦═╗
  ║ ║║║║║║║╠═╣╠═╝╠═╝║╣ ╠╦╝
  ╚═╝╝╚╝╩ ╩╩ ╩╩  ╩  ╚═╝╩╚═ v1.2.0
  ─────────────────────────────────────
  JavaScript Source Map Reverser
  Extract source code from .js.map files
  For authorized security testing only

[*] Probing JS file: https://target.com/app.js
[+] Found source map: https://target.com/app.js.map
[*] Detection method: sourceMappingURL
[*] Extracting to: ./out
═══════════════════════════════════════════════════════
  ✓ Extracted 156 source files
═══════════════════════════════════════════════════════

  SUMMARY
  ├─ JS URL: app.js
  ├─ Map URL: app.js.map
  ├─ Files extracted: 156
  └─ Output: ./out

API

const { 
  extractFromFile, 
  extractFromUrl,
  probeJsUrl, 
  spiderPage 
} = require('unmapper')

// Extract from local file
const result = await extractFromFile('app.js.map', './output')

// Extract from remote URL
const result = await extractFromUrl('https://target.com/app.js.map', './output')

// Probe a JS file for its source map
const probe = await probeJsUrl('https://target.com/app.js')
if (probe.ok && probe.hasSourcesContent) {
  console.log('Map URL:', probe.mapUrl)
}

// Spider a page for all source maps
const spider = await spiderPage('https://target.com/')
console.log('Found maps:', spider.found.length)

Why?

Developers sometimes accidentally deploy source maps to production. This tool helps security researchers:

| Use Case | Description | |----------|-------------| | Reconnaissance | Understand the application's internal structure | | Code Review | Find vulnerabilities in the original source | | Secret Discovery | Locate hardcoded API keys, endpoints, etc. |

License

MIT License - Felipe Fortunato