JavaScript Surface Analyzer

Purpose

Extract attacker-relevant intelligence from front-end code and convert it into testable hypotheses.

Inputs

• target_url
• seed_pages (optional)
• auth_context (optional)

Workflow

Phase 1: Asset Enumeration

1. Collect static and dynamic script URLs.
2. Expand via source maps and chunk manifests where available.
3. Track script origin, load condition, and execution context.