Tool
jsluice
Bishop Fox's Go library and command-line tool that parses JavaScript with tree-sitter to recover the endpoints a script calls, judging values by how the code uses them rather than by regular expressions alone. URL extraction follows location assignments, window.open, fetch, XMLHttpRequest and jQuery request calls, keeps the HTTP method, headers and query or body parameters, and stands in a placeholder for values only known at run time. Other modes flag credential-shaped values, print syntax trees, run tree-sitter queries and reformat minified code.
- Targets
- Website
- Category
- Website analysis tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- The project publishes no releases or tags: the README installs the CLI with go install and the package with go get. go.mod declares Go 1.18 and pins go-tree-sitter, goquery, jsbeautifier-go and a WARC reader. The reviewed main commit dates from 2024-01-10; the repository has Go unit tests and JavaScript fixtures but no CI workflow.
- Inputs are JavaScript files, HTML pages whose inline scripts it extracts, WARC archives, raw source on stdin, or http(s) URLs fetched with optional cookies and headers; output is JSONL. The analysis is static: concatenated runtime values appear as EXPR or a chosen placeholder, and the README calls the approach not foolproof, so extracted endpoints are leads to check against the application.
- secrets mode ships active matchers only for AWS, GCP and GitHub key formats and Firebase configuration objects, plus user-supplied JSON pattern files; the README shows that unanchored custom patterns match unintended values. Matches are pattern hits, not confirmed credentials.
- MIT, copyright 2023 Bishop Fox.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.mkd GitHub · BishopFox/jsluice · Revision 0ddfab1
- cmd/jsluice/README.mkd GitHub · BishopFox/jsluice · Revision 0ddfab1
- go.mod GitHub · BishopFox/jsluice · Revision 0ddfab1
- analyzer.go#L23-L43 GitHub · BishopFox/jsluice · Revision 0ddfab1
- secret-matchers.go#L91-L98 GitHub · BishopFox/jsluice · Revision 0ddfab1
- cmd/jsluice/main.go GitHub · BishopFox/jsluice · Revision 0ddfab1
- LICENSE GitHub · BishopFox/jsluice · Revision 0ddfab1
More in Websites
- REstringer · Tool
- Chrome extension source viewer (CRX Viewer) · Tool
- har-to-openapi · Tool
- decode-js · Tool
- javascript-deobfuscator (LostMyCode) · Tool
- minusone · Tool