R-JSL
jsluice
Go library and CLI that parses JavaScript into an AST to extract URLs, endpoints, and secrets more accurately than regex-based extractors.
OVERVIEW
jsluice (github.com/BishopFox/jsluice), written in Go by Tom Hudson at Bishop Fox, parses JavaScript source with go-tree-sitter to build a real abstract syntax tree instead of scanning text with regular expressions. That lets it understand context that regex extractors miss — for example that a string is being assigned to document.location, passed as the first argument to fetch(), or set as a value inside an object literal that looks like an API client config — rather than just matching an https:// pattern wherever it appears.
It handles string concatenation by tracing it through the AST and substitutes any expression it can't resolve statically with a placeholder (EXPR), so a URL built from several variables still gets partially recovered instead of silently skipped. Beyond URLs, its secrets mode ships pattern definitions for common API key and token formats, and its query mode exposes raw tree-sitter queries for custom extraction against a specific app's JS patterns.
USE CASES
Practical use cases
- 01
Extracting hidden API endpoints from large, bundled, or minified JavaScript during recon.
- 02
Finding hardcoded API keys, tokens, or credentials left in client-side code.
- 03
Reducing false positives compared to grep/regex-based JS secret scanners on heavily bundled apps.
- 04
Writing custom tree-sitter queries (query mode) to pull app-specific patterns regex can't express.
QUICK START
When a target ships large or bundled JavaScript worth mining for hidden endpoints, API keys, or internal URLs during recon.
- Collect the in-scope JavaScript files or bundles, via crawling, archived URLs, or direct download.
- Install jsluice with go install.
- Run it in urls mode against a file or a directory of JS to extract endpoints.
- Run it in secrets mode to check the same files for known API key/token patterns.
- Manually verify any flagged endpoint or secret before treating it as a real finding.
jsluice urls app.bundle.jsBEFORE YOU RUN IT
What to check before running it
It surfaces candidate URLs and secrets from static analysis, not confirmed live findings — an extracted endpoint may be dead code, and an extracted 'secret' may be a placeholder or test value.
A discovered API key or credential is sensitive data the moment it's extracted — handle it per the engagement's evidence rules rather than pasting it into scratch notes or tickets.
It only sees what's statically present in the JavaScript source; runtime-constructed URLs or secrets fetched dynamically from another endpoint won't appear.