Hacking Tools

JS Snitch : Hidden Secrets In JavaScript Files

JS Snitch is a powerful command-line tool designed to scan remote JavaScript files for potential secrets or credentials.

It leverages the capabilities of Trufflehog and Semgrep to automate the detection of leaked API keys, tokens, or other sensitive information hidden in external JavaScript files.

This tool is particularly useful for penetration testers, bug bounty hunters, and security engineers seeking to identify vulnerabilities in web applications.

Key Features Of JS Snitch

  • Multi-host Scanning: JS Snitch allows users to scan a single host or a list of hosts, making it efficient for large-scale security audits.
  • Trufflehog Integration: It utilizes Trufflehog’s advanced scanning capabilities to detect secrets within JavaScript files.
  • Semgrep Integration: Configurable Semgrep rulesets enable additional scanning and pattern-based detection of potential vulnerabilities.
  • Beautification Step: Automatically prettifies downloaded JavaScript files for better readability during manual analysis.
  • Aggregated Results: Consolidates findings from both Trufflehog and Semgrep into a single, easy-to-understand report.
  • Unverified vs. Verified Secrets: Clearly distinguishes between verified and unverified secrets, helping users prioritize further investigation.

To use JS Snitch, follow these steps:

  1. Clone the repository: $ git clone https://github.com/vavkamil/js-snitch.git
  2. Navigate to the cloned directory: $ cd js-snitch
  3. Install dependencies: $ pip install -r requirements.txt
  4. Run the tool: $ python js_snitch.py

You can scan a single host using the --host option or a list of hosts using the --list option.

After scanning, JS Snitch organizes its findings in a structured output directory. The folder structure includes:

  • tmp/: Raw JavaScript files as downloaded.
  • beautify/: Beautified JavaScript files for easier analysis.
  • secrets.json: Raw Trufflehog output.
  • semgrep_output.json: Raw Semgrep output.
  • secrets.txt: Consolidated report of findings from both tools.

The secrets.txt file provides a human-readable summary of detected secrets, including their type and verification status, along with references to the corresponding beautified files for further inspection.

JS Snitch simplifies the process of identifying potential security risks in web applications by automating the detection of leaked credentials in JavaScript files.

Its integration with powerful tools like Trufflehog and Semgrep makes it a valuable asset for security professionals.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

How to Install Docker on Ubuntu (Step-by-Step Guide)

Docker is a powerful open-source containerization platform that allows developers to build, test, and deploy…

4 days ago

Uninstall Docker on Ubuntu

Docker is one of the most widely used containerization platforms. But there may come a…

4 days ago

Admin Panel Dorks : A Complete List of Google Dorks

Introduction Google Dorking is a technique where advanced search operators are used to uncover information…

5 days ago

Log Analysis Fundamentals

Introduction In cybersecurity and IT operations, logging fundamentals form the backbone of monitoring, forensics, and…

6 days ago

Networking Devices 101: Understanding Routers, Switches, Hubs, and More

What is Networking? Networking brings together devices like computers, servers, routers, and switches so they…

7 days ago

Sock Puppets in OSINT: How to Build and Use Research Accounts

Introduction In the world of Open Source Intelligence (OSINT), anonymity and operational security (OPSEC) are…

1 week ago