📄️ Run command
The run command is a powerful feature that automates most of the JavaScript reconnaissance workflow by executing a series of modules in a predefined order. This command is ideal for users who want to perform a basic analysis of a target without running each module individually.
📄️ Lazyload command
The lazyload command is used to download JavaScript files from a given URL or a list of URLs. It simulates various techniques to discover and fetch JS files that are loaded dynamically.
🗃️ Lazyload Reference
1 item
📄️ Strings command
The strings command is used to extract strings, URLs, and secrets from a directory of JavaScript files. This is useful for identifying sensitive information and potential API endpoints.
📄️ Map command
The map command is used to map and analyze the functions within a directory of JavaScript files. It can help you understand the codebase by identifying function definitions and, optionally, using AI to generate descriptions.
🗃️ Map Reference
5 items
📄️ Endpoints command
The endpoints command is used to extract client-side endpoints from a directory of JavaScript files and mapped.json file. It identifies potential client-side paths and organizes them for further analysis.
📄️ Analyze command
The analyze command is used to analyze a file the output files of JS recon modules to determine if they contain sensitive info or not.
📄️ Exploit command
The exploit command attempts exploitation of known framework CVEs against a live target to
📄️ Report command
The report command generates a report based on the results of the analyze module.
📄️ Refactor Command
The refactor command processes the mapped JSON file generated by the map command and outputs the refactored JavaScript files to a specified directory. This is particularly useful for code transformation and restructuring tasks.
🗃️ Refactor Technology Reference
8 items
📄️ sourcemaps command
The sourcemaps command extracts the original source files embedded in .map sourcemap files. This is useful when you already have sourcemap files and want to recover the original source code without running the full pipeline.
📄️ Load command
The load command populates the response cache from an HTTP request-history export (currently a Caido JSON export). Once the cache is populated, subsequent js-recon runs against the same target can be executed entirely offline by pairing this command with --cache-only.
📄️ Proxy command
The proxy command configures and manages an outbound proxy used to route js-recon's requests
🗃️ Proxy Reference
4 items
📄️ Fingerprint command
The fingerprint command detects the front-end JavaScript framework used by one or more target URLs. It is useful for quickly profiling a list of targets before running a full lazyload or run pipeline.
📄️ CS-MAST command
The cs-mast command computes CS-MAST-S (Context-Stratified Merkelized Abstract Syntax Tree) signatures for every .js file found in an output directory and optionally finds structural collisions — files that share the same CS-MAST-S root signature, meaning they are structurally and semantically equivalent under the chosen configuration.
📄️ MCP command
The mcp command has three modes:
📄️ Completion command
The completion command generates a shell completion script for js-recon. Once installed, pressing Tab after js-recon lists all available subcommands, and pressing Tab after js-recon lists all flags for that subcommand.
📄️ taintwire command
The taintwire command builds a PookieGraph (a .pg file) from a directory of JavaScript files and runs pgq query files against it. A PookieGraph holds the taintwire graph of every file: the syntax tree, scopes, value flow, and, for webpack and Turbopack builds, the links between chunks through the bundler's module registry. A .pgq file is a TypeScript module of Cypher selectors and rules; the pgq reference describes the format. The taintwire-queries repository is the public query pack. Its queries are written with pga (PookieGraph aliases), short names such as ${pga.methodCall()} for the Cypher fragments queries repeat, and share their sinks through sink sets such as htmlSinks. The pga reference lists every alias, what it expands to, and each sink set.