Hacking Tools

JS Snitch : Hidden Secrets In JavaScript Files

JS Snitch is a powerful command-line tool designed to scan remote JavaScript files for potential secrets or credentials.

It leverages the capabilities of Trufflehog and Semgrep to automate the detection of leaked API keys, tokens, or other sensitive information hidden in external JavaScript files.

This tool is particularly useful for penetration testers, bug bounty hunters, and security engineers seeking to identify vulnerabilities in web applications.

Key Features Of JS Snitch

  • Multi-host Scanning: JS Snitch allows users to scan a single host or a list of hosts, making it efficient for large-scale security audits.
  • Trufflehog Integration: It utilizes Trufflehog’s advanced scanning capabilities to detect secrets within JavaScript files.
  • Semgrep Integration: Configurable Semgrep rulesets enable additional scanning and pattern-based detection of potential vulnerabilities.
  • Beautification Step: Automatically prettifies downloaded JavaScript files for better readability during manual analysis.
  • Aggregated Results: Consolidates findings from both Trufflehog and Semgrep into a single, easy-to-understand report.
  • Unverified vs. Verified Secrets: Clearly distinguishes between verified and unverified secrets, helping users prioritize further investigation.

To use JS Snitch, follow these steps:

  1. Clone the repository: $ git clone https://github.com/vavkamil/js-snitch.git
  2. Navigate to the cloned directory: $ cd js-snitch
  3. Install dependencies: $ pip install -r requirements.txt
  4. Run the tool: $ python js_snitch.py

You can scan a single host using the --host option or a list of hosts using the --list option.

After scanning, JS Snitch organizes its findings in a structured output directory. The folder structure includes:

  • tmp/: Raw JavaScript files as downloaded.
  • beautify/: Beautified JavaScript files for easier analysis.
  • secrets.json: Raw Trufflehog output.
  • semgrep_output.json: Raw Semgrep output.
  • secrets.txt: Consolidated report of findings from both tools.

The secrets.txt file provides a human-readable summary of detected secrets, including their type and verification status, along with references to the corresponding beautified files for further inspection.

JS Snitch simplifies the process of identifying potential security risks in web applications by automating the detection of leaked credentials in JavaScript files.

Its integration with powerful tools like Trufflehog and Semgrep makes it a valuable asset for security professionals.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Networking Devices 101: Understanding Routers, Switches, Hubs, and More

What is Networking? Networking brings together devices like computers, servers, routers, and switches so they…

1 hour ago

Sock Puppets in OSINT: How to Build and Use Research Accounts

Introduction In the world of Open Source Intelligence (OSINT), anonymity and operational security (OPSEC) are…

3 hours ago

What is SIEM? Complete Guide to Security Information and Event Management

Introduction As cyber threats grow more sophisticated, organizations need more than just firewalls and antivirus…

12 hours ago

Website OSINT: Tools and Techniques for Reconnaissance

Introduction When it comes to cybersecurity and ethical hacking, one of the most effective ways…

1 day ago

Top OSINT Tools to Find Emails, Usernames and Passwords

Introduction In the world of cybersecurity, knowledge is power. One of the most powerful skillsets…

2 days ago

Google Dorking in Cybersecurity: A Complete Guide

Introduction In the vast ocean of the internet, the most powerful tool you already have…

2 days ago