JavaScript tools for BugBounty 2024

ffuf

https://github.com/ffuf/ffuf

Zap

https://www.zaproxy.org/download/

Burp Suite

https://portswigger.net/burp

js-beautify

https://beautifier.io/

ParamSpider

https://github.com/devanshbatham/ParamSpider

Arjun

https://github.com/s0md3v/Arjun

JSFScan

https://github.com/KathanP19/JSFScan.sh

gau

https://github.com/lc/gau

SecretFinder

https://github.com/m4ll0k/SecretFinder

LinkFinder

https://github.com/GerbenJavado/LinkFinder

JSParser

https://github.com/nahamsec/JSParser

de4js

https://lelinhtinh.github.io/de4js/

GoLinkFinder

https://github.com/0xsha/GoLinkFinder

getJS

https://github.com/003random/getJS

What you’re looking for in JavaScript

New endpointsNew parameters

Deobfuscating javascript

API keys

Reading JS to a real finding

Developer comments (for example // this is a dev comment or /* This is a multi-line dev comment */) can sometimes contain information such as when the code was published or any updates that have occurred (in the past I have found notes regarding XSS filtering which helped me to understand how they fixed it and thus lead to a bypass

Automating reading .js files

https://github.com/003random/getJShttps://github.com/jobertabma/relative-url-extractorhttps://github.com/0xsha/GoLinkFinder