js-secrets-extraction

1# JS Bundle & Source Map Analysis -- Secret Extraction
2 
3## When to Use
4 
5- **ALWAYS** after initial web enumeration
6- When you find modern SPA (React, Angular, Vue)
7- When target uses Firebase, Supabase, Auth0
8- Higher yield than directory scanning on many targets
9 
10## Prerequisites
11 
12- Explicit authorization, target boundaries, and rate limits for the target.
13- Tooling: `curl`, `python3`, `waybackurls`.
14- A writable evidence directory: `export OUTPUT_DIR="${OUTPUT_DIR:-./output}" && mkdir -p "$OUTPUT_DIR"`.
15- For any state-changing step (writes, uploads, credential attempts), obtain explicit confirmation immediately before the command.
16 
17## How to Run
18 
19```bash
20curl --max-time 30 --connect-timeout 10 -s "https://target.com" > index.html
21grep -Eo 'src="[^"]*\.js"' index.html | cut -d'"' -f2 | while read js; do
22  curl --max-time 30 --connect-timeout 10 -s "https://target.com$js" > "$(basename $js)"
23done
24 
25# Search for secrets in bundles
26grep -rEn "(apiKey|api_key|API_KEY|token|secret|password|clientId|client_id|auth0|firebase|supabase)[\"'\"]?[[:space:]]*[:=][[:space:]]*[\"'\'][^\"'\']{8,}" *.js
27```
28 
29## Procedure
30 
31The phases below are the procedure. Keep each probe bounded (`--max-time`), record evidence beneath `OUTPUT_DIR`, and stop at the stop-conditions listed in Pitfalls.
32 
33## Why Analyze JS Bundles
34 
35Modern JavaScript bundles (Webpack, Vite, esbuild) often contain:
36- Hardcoded API keys and tokens
37- Internal API URLs
38- Firebase, Auth0, Supabase configurations
39…