🕷️ The Ultimate JavaScript Reconnaissance Framework for Bug Bounty Hunters 🕷️
A complete, interactive cheat sheet for hunting secrets and APIs in JavaScript files. This guide covers:
- ✅ Manual reconnaissance techniques
- ✅ Automated subdomain enumeration
- ✅ Mass JS file harvesting (live + archived)
- ✅ Secret & API key scanning
- ✅ Burp Suite workflow
- ✅ Professional report writing tips
All the tools mentioned in this guide:
| Tool | Description | Link |
|---|---|---|
| Subfinder | Fast subdomain enumeration | 🔗 GitHub |
| Katana | Next-gen web crawler | 🔗 GitHub |
| Hakrawler | Simple, fast web crawler | 🔗 GitHub |
| Httpx | HTTP probing toolkit | 🔗 GitHub |
| GAU | Fetch URLs from archives | 🔗 GitHub |
| Waybackurls | Fetch Wayback Machine URLs | 🔗 GitHub |
| Tool | Description | Link |
|---|---|---|
| JSLuice | Extract secrets using AST parsing | 🔗 GitHub |
| Mantra | Find API keys and secrets | 🔗 GitHub |
| SecretFinder | Find sensitive data in JS | 🔗 GitHub |
| LinkFinder | Extract endpoints from JS | 🔗 GitHub |
| JSLeak | Extract URLs from JS files | 🔗 GitHub |
| Cariddi | Extract URLs and secrets | 🔗 GitHub |
| Nuclei | Vulnerability scanner | 🔗 GitHub |
| Tool | Description | Link |
|---|---|---|
| SubJS | Extract JS links from pages | 🔗 GitHub |
| Anew | Append unique lines | 🔗 GitHub |
╔══════════════════════════════════════════════════════════════╗
║ ║
║ 🦇 N I G H T C R A W L E R v 2 . 0 🦇 ║
║ ║
║ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ║
║ ║
║ "The tool I use when I want to find secrets ║
║ that others miss." ║
║ ║
║ [████████████████████████░░░░░░░░] 70% COMPLETE ║
║ ║
╚══════════════════════════════════════════════════════════════╝
| Feature | Status |
|---|---|
| 200+ Validated Patterns | ✅ Ready |
| Async Scanning (50+ threads) | ✅ Ready |
| Built-in Subdomain Enumeration | ✅ Ready |
| Pattern Validation (No False Positives) | ✅ Ready |
| Rich Terminal UI | ✅ Ready |
| One-Click Full Recon | ✅ Ready |
# One command. Full recon. Zero noise.
python3 nightcrawler.py -t target.com -c 50
# Results:
# ✅ 16 subdomains found
# ✅ 247 JS files scanned
# ✅ 12 VALIDATED secrets found
# ✅ 0 false positives⏳ Stay tuned... Only for CyberTechAjju Community! ⏳
js-recon-guide/
├── index.html # Interactive guide (GitHub Pages)
└── README.md # This file
⭐ Star this repo if it helped you find bugs! ⭐