SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsjs-api-extract

js-api-extract

Security & auditing

View repository

Updated 10-16 09:35

About this skill

JavaScript API Endpoint Extraction Methodology

In a decoupled frontend-backend architecture, JS bundles are the API endpoints'largest information source— 10 times more efficient than directory scanning.

⛔ In-depth reference (required reading)

Phase 1: JS File Collection

1.1 Collect from page HTML

# 抓取页面中所有 JS 引用
curl -s "$TARGET" | grep -oE '(src|href)="[^"]*\.js[^"]*"' | sed 's/.*="\(.*\)"/\1/'
Recursive crawling (including iframe/dynamic loading)

curl -s "$TARGET" | grep -oP '(?:src|href|url)\s*[=:]\s*"\x27["\x27]' | sort -u


### 1.2 从 Source Map 恢复
```bash
# 检查 JS 文件末尾的 sourceMappingURL
curl -s "$TARGET/static/js/app.xxx.js" | tail -1
# 如果有 //# sourceMappingURL=app.xxx.js.map
curl -s "$TARGET/static/js/app.xxx.js.map" -o sourcemap.json

# Source Map 暴露完整源码——等于拿到了前端源码

1.3 Collect from Webpack manifest

# 常见 chunk 清单文件
/static/js/manifest.json
/asset-manifest.json
/webpack-manifest.json
/build/asset-manifest.json
/static/js/runtime~main.xxx.js  # runtime chunk 包含所有 chunk 映射

1.4 Historical versions

# Wayback Machine 获取旧版 JS（可能包含已删除但未下线的 API）
curl -s "https://web.archive.org/cdx/search/cdx?url=$DOMAIN/*.js&output=text&fl=original" | sort -u

Phase 2: API Endpoint Extraction

2.1 Path pattern extraction

# 从 JS 内容中提取 API 路径（最核心的一步）
curl -s "$JS_URL" | grep -oP '["'"'"'](/(?:api|v[0-9]|rest|service|graphql|ws|internal|admin|auth|user|public)[^\s"'"'"']*?)["'"'"']' | sort -u

# 拼接路径提取（前端常见写法：baseURL + path）
curl -s "$JS_URL" | grep -oP '(?:baseURL|BASE_URL|API_URL|apiPrefix|apiBase)\s*[=:]\s*["'"'"']([^"'"'"']+)["'"'"']'

# 通用路径提取（含相对路径）
curl -s "$JS_URL" | grep -oP '["'"'"'](/[a-zA-Z][a-zA-Z0-9_/\-]{2,}(?:\?[^"'"'"']*)?)["'"'"']' | sort -u | grep -v '\.\(js\|css\|png\|jpg\|svg\|ico\|woff\|ttf\)'

2.2 Full URL extraction

# 提取完整的 HTTP(S) URL
curl -s "$JS_URL" | grep -oP 'https?://[^\s"'"'"'<>]+' | sort -u

# 提取内部域名/子域名
curl -s "$JS_URL" | grep -oP 'https?://[a-zA-Z0-9._-]+\.DOMAIN\.com[^\s"'"'"']*' | sort -u

2.3 Key information extraction

# API Key / Secret / Token
curl -s "$JS_URL" | grep -oiP '(?:api[_-]?key|secret|token|auth|password|credential)\s*[=:]\s*["'"'"']([^"'"'"']{8,})["'"'"']'

# WebSocket 端点
curl -s "$JS_URL" | grep -oP 'wss?://[^\s"'"'"']+' | sort -u

# 内部 IP/域名
curl -s "$JS_URL" | grep -oP '(?:10|172\.(?:1[6-9]|2\d|3[01])|192\.168)\.\d+\.\d+' | sort -u

Phase 3: Endpoint Classification and Prioritization

After extraction, classify by security value:

Priority Characteristics Description
🔴 High /admin/, /internal/, /debug/, /manage/ Administrative functionality, may lack authentication
🔴 High /upload, /import, /export, /download File operations, may have path traversal/arbitrary read-write
🔴 High /user/, /account/, /profile/, /order/ User data operations, IDOR hotspot
🟡 Medium /auth/, /login/, /register/, /reset/ Authentication flow, may have logic bypass
🟡 Medium /search, /query, /filter Query interfaces, SQL injection hotspot
🟢 Low /static/, /public/, /health, /status Static resources/health checks

Phase 4: Batch Verification

# 对提取的端点逐一验证存活
for path in $(cat extracted_paths.txt); do
    code=$(curl -s -o /dev/null -w "%{http_code}" "$TARGET$path" --connect-timeout 5 -m 10)
    echo "$code $path"
done | grep -v "^404 " | sort

Key points to watch：

  • 200 → Directly accessible, check response content
  • 401/403 → Exists but requires authentication, try to bypass
  • 405 → Endpoint exists but method is wrong, try POST/PUT/DELETE
  • 500 → Backend error, may have injection point
  • 301/302 → Follow redirect target

Output Requirements

After extraction, output:

  1. JS file inventory — which JS files were analyzed
  2. List of discovered API endpoints — sorted by priority
  3. Exposed sensitive information — API Keys, internal domains, Tokens
  4. Recommended next testing steps — which endpoints should be fuzzed first