JSEye v3.1.0 represents a massive architectural leap from passive reconnaissance to fully autonomous, intelligent bug hunting. Designed specifically for elite offensive security engineers, JSEye natively executes infinite-depth recursion, dynamic parameter fuzzing, and mathematically deduplicated crawling—requiring zero configuration files.
Just point it at a target, and JSEye builds the entire attack surface.
Forget source downloads and configuration files. JSEye v3.1.0 is deployed exclusively as a self-contained pip package handling its own Go-toolchain compilation implicitly.
# Global pip installation
pip install jseye
# Bypass externally managed environment warnings (WSL/Kali)
pip install jseye --break-system-packagesRequired: Python 3.8+
JSEye v3.1.0 drops legacy crutches and replaces them with 8 native Python engines:
- Autonomous Scope Derivation Engine: No more
scope.txt. Give JSEye a URL, and it leveragestldextractto mathematically compute the root domain, mapping all internal subdomains dynamically while locking out third-party analytics trackers. - Infinite Recursive Queue: JSEye now seamlessly unspools JavaScript imports, XHR endpoints, and dynamic routing logic infinitely. It crawls until the asset landscape is exhausted.
- Global Deduplication Engine: Prevents the "infinite pagination loop" crawler death. Deep URL normalization and response-body hashing guarantee discrete endpoint discovery.
- Active Prober Engine (
--active): Passive is no longer enough. JSEye actively baselines endpoints and executes safe parameter mutations to map Reflection, CORS mismatches, and Auth Bypasses. - Structured Intelligence Output: Automatically drops sorted
urls/,endpoints/,secrets/,requests/, andexports/into a timestamped directory artifact. - Dependency Confusion Analyzer: Automatically discovers package.json files and analyzes dependencies for supply chain vulnerabilities including dependency confusion, takeover opportunities, and suspicious versions.
- Dynamic CVE Intelligence: Detects library versions from JavaScript files and queries free CVE databases (OSV, NVD) for known vulnerabilities with severity classification.
- Comprehensive API Detection: Identifies 50+ API patterns including REST, GraphQL, Authentication, Admin panels, and internal APIs with automatic classification.
- Zero-Touch Tool Orchestration: Transparently multiplexes
subfinder,katana,gau,waybackurls,hakrawler, andmantraasynchronously. - Deep JS AST Analysis: Employs headless browser rendering and AST parsing to extract dynamically loaded parameters and endpoints that defeat standard static regex.
- Swagger / OpenAPI Mapping: Scans over 200+ known endpoints and dynamically parses OpenAPI/Swagger specifications (v2/v3).
- Advanced Secret Contextualization: Not just regex matching—identifies if a leaked AWS key is dynamically inserted into an
Authorizationheader during async runtime. - Vulnerability & CVE Mapping: Identifies obsolete library versions mapping them dynamically to NVD/OSV.
- Dependency Confusion Detection: Discovers package.json files and analyzes dependencies for supply chain attacks including private packages in public registries, missing packages (takeover opportunities), and suspicious version patterns.
- Intelligent Noise Filtering: Context-aware engine filters out metrics/analytics noise, focusing only on high-value, actionable assets.
JSEye thrives on the CLI. It's built for rapid, chained terminal workflows.
Execute the full unconstrained, autonomous recursive crawl including active parameter mutation probing:
jseye https://target.com --all --activeRunning on a constrained VDP? Cap the internal recursion depth and maximum HTTP baseline requests:
jseye https://target.com --max-depth 5 --max-requests 500Already have your target locked and don't want JSEye looking for lateral subdomains? Bypass subfinder entirely:
jseye https://target.com --no-subsFocus only on high-fidelity, exploitable findings (removes 95% of standard framework noise) and drop outputs silently into a pipeline directory:
jseye https://target.com --actionable --aggressive-filter --silent -o /tmp/target_intelCompare a fresh scan against a baseline JSON report to spot newly added endpoints, shadow APIs, or leaked secrets in real-time. Powerful in cron jobs:
jseye https://target.com --compare previous_report.json --json --silentJSEye translates findings directly into weaponized formats for your secondary toolchain:
# Generate a Nuclei template for custom fuzzing
jseye https://target.com --export-nuclei custom_nuclei.yaml
# Generate ffuf commands perfectly tailored to the discovered parameters
jseye https://target.com --export-ffuf ffuf_commands.sh
# Export a Burp Suite sitemap for localized manual API testing
jseye https://target.com --export-burp sitemap.xmlJSEye executes a tightly controlled, infinite-loop BFS queue architecture:
graph TD
A[Input Target] -->|Scope Engine| B[Auto-Derive Root/Subdomain Scope]
B --> C[Initial Seed Generation]
C -->|subfinder, gau, hakrawler| D[V2 Autonomous Recursive Queue]
D --> E{URL Type Check}
E -->|JavaScript| F[AST & Regex Extraction]
E -->|HTML/API| G[Headless DOM flow]
F -->|Links & Parms| H[Global Deduplication Engine]
G -->|Links & Parms| H
H -->|New Unique Links| D
H -->|Findings| I[Secret & API Intelligence]
I --> J[Active Prober Mutation]
J --> K[Actionable Noise Filter]
K --> L[V2 Structured Output Engine]
JSEye v3.1.0 includes a comprehensive dependency analyzer that automatically discovers and analyzes package.json files to identify supply chain vulnerabilities.
-
Dependency Confusion Attacks
- Private packages (@scoped, -internal, -private) that exist in public NPM registry
- Risk: Attackers can publish malicious packages with same name to public registry
- Severity: CRITICAL
-
Package Takeover Opportunities
- Dependencies that don't exist in NPM registry
- Risk: Abandoned or typo'd packages can be registered by attackers
- Severity: HIGH
-
Suspicious Version Patterns
- Development versions (0.0.x, -dev, -alpha, -beta, -rc)
- Risk: Unstable or test packages in production
- Severity: MEDIUM
-
Typosquatting Detection
- Similar package names that might be malicious clones
- Uses fuzzy matching to identify potential typosquatting
- Severity: MEDIUM
The analyzer automatically:
- Discovers package.json, package-lock.json, yarn.lock, pnpm-lock.yaml files
- Extracts all dependencies (dependencies, devDependencies, peerDependencies, optionalDependencies)
- Checks each package against NPM public registry
- Identifies private packages using pattern matching
- Calculates risk scores (0-100) with severity levels
- Reports top vulnerable dependencies with actionable insights
[Phase 7.8] Dependency Confusion Analysis
Total Dependencies: 127
Vulnerable Packages: 8
Critical: 2 | High: 3 | Medium: 3
Confusion Risk: 2 packages
Missing Packages: 3 packages
Top Vulnerable Dependencies:
1. @company/internal-api (CRITICAL - Risk: 85)
- Private package exists in public NPM registry
- Dependency confusion attack vector
2. legacy-auth-lib (HIGH - Risk: 65)
- Package not found in NPM registry
- Takeover opportunity
3. react-utils-dev (MEDIUM - Risk: 45)
- Suspicious version: 0.0.1-dev
Dependency confusion findings are automatically included in all export formats:
- Wordlist: Vulnerable package names for further investigation
- JSON Report: Complete vulnerability analysis with risk scores
- HTML Report: Visual dashboard with severity breakdown
- Nuclei Template: Custom templates for dependency testing
- Curl Commands: API calls to verify package existence
For developers customizing the intelligence engines natively, JSEye includes automated scripts to construct and install editable pip distributions cleanly.
# Windows (PowerShell)
.\build.ps1
# Linux / macOS (Bash)
./build.shThese wrappers securely clean legacy artifacts, upgrade your Python build layer, compile the wheel, and force-install the native binary into your path.
Contributions are welcome! JSEye is actively maintained to map the modern JavaScript threat landscape.
This project is licensed under the MIT License.