JS Snitch is a powerful command-line tool designed to scan remote JavaScript files for potential secrets or credentials.
It leverages the capabilities of Trufflehog and Semgrep to automate the detection of leaked API keys, tokens, or other sensitive information hidden in external JavaScript files.
This tool is particularly useful for penetration testers, bug bounty hunters, and security engineers seeking to identify vulnerabilities in web applications.
To use JS Snitch, follow these steps:
$ git clone https://github.com/vavkamil/js-snitch.git
$ cd js-snitch
$ pip install -r requirements.txt
$ python js_snitch.py
You can scan a single host using the --host
option or a list of hosts using the --list
option.
After scanning, JS Snitch organizes its findings in a structured output directory. The folder structure includes:
The secrets.txt
file provides a human-readable summary of detected secrets, including their type and verification status, along with references to the corresponding beautified files for further inspection.
JS Snitch simplifies the process of identifying potential security risks in web applications by automating the detection of leaked credentials in JavaScript files.
Its integration with powerful tools like Trufflehog and Semgrep makes it a valuable asset for security professionals.
Docker is a powerful open-source containerization platform that allows developers to build, test, and deploy…
Docker is one of the most widely used containerization platforms. But there may come a…
Introduction Google Dorking is a technique where advanced search operators are used to uncover information…
Introduction In cybersecurity and IT operations, logging fundamentals form the backbone of monitoring, forensics, and…
What is Networking? Networking brings together devices like computers, servers, routers, and switches so they…
Introduction In the world of Open Source Intelligence (OSINT), anonymity and operational security (OPSEC) are…