PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Introducing jsluice: A Technical Deep-Dive for JavaScript Gold (Part 2)

bishopfox.com | blog | #open-source | #web-security | #security-tools | #javascript | #static-analysis | #jsluice
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A technical deep-dive into jsluice's four modes—urls, secrets, tree, and query—and how its syntax-tree analysis extracts endpoints, methods, and headers from fetch and XMLHttpRequest JavaScript.
Published
Collected

Related coverage

blog · hackenproof.com
How to use Slither for auditing smart contracts
A hands-on guide to Slither, the Python-based Solidity static analysis framework: installing via pip or Docker, pointing it at a contract, project or mainnet address, and reading its findings.
blog · hackenproof.com
How to use MythX for smart contract auditing
A hands-on guide to MythX, an automated EVM smart contract scanner combining static analysis, dynamic analysis and symbolic execution, from CLI setup and API keys to deep-scan reports.
tool · github.com
Peach: Single-user, Local-first Personal Media Library and Management System
Offers a privacy-respecting, local-first alternative for media library indexing and playback, combining cloud-drive integration with automated scraping while keeping sensitive viewing data strictly local.
tool · github.com
Droid ASC: High-Performance On-Demand Android Decompiler Front-End for Mobile Security & AI Agents
Radically reduces Android reverse-engineering overhead from tens of minutes and gigabytes of memory to milliseconds and megabytes, providing an ideal, stateless code analysis primitive for autonomous security agents and vulnerability researchers.
tool · github.com
Ghost-Js-Burp-Extension: Burp Suite Extension to Detect Hardcoded Secrets & Endpoints in JavaScript
Streamlines JavaScript reconnaissance during bug bounty hunting and web penetration testing by uncovering hidden attack surfaces and exposed secrets with minimal noise.
blog · bishopfox.com
Introducing jsluice: The Why Behind JavaScript Gold Mining (Part 1)
Part one of the jsluice series traces how the shift from link-based HTML to JavaScript single-page apps broke classic web crawling, motivating a tool that sifts useful data from megabytes of JS.
Back