📂 JavaScript Analysis & API Enumeration (2025)
The 2025 enumeration phase focuses on client-side routing structures and unexposed REST/GraphQL API path mappings.
📜 JavaScript Mining & URL Discovery
Modern web apps use thick JS bundles. We extract endpoints using subjs and LinkFinder:
# Extract JS locations
cat live_web_assets.txt | subjs > js_files.txt
# Extract URLs from JavaScript files
python3 linkfinder.py -i https://target.com/assets/main.js -o cli > extracted_links.txt
🔌 API Endpoint Resolution
We brute-force API gateways using specialized tools and route files:
# Kiterunner API route discovery
kr scan https://api.target.com -A=apiroutes-210228 -o api_endpoints.txt
🔑 Batch Parameter Fuzzing
We guess hidden parameters using Arjun and x8:
# Fuzz JSON POST parameter fields
arjun -u https://target.com/api/v2/update -m POST --json
# Run x8 for fast parameter discovery
x8 -u "https://target.com/index.php" -w parameters.txt