A browser extension for authorized security testing. It inspects the JavaScript a page has already loaded — including source maps — and surfaces API endpoints, subdomains, URLs, and likely-secret material. Everything runs locally.
Three passes — collect, analyze, triage — turn already-loaded page JavaScript into a prioritized recon report, with zero requests beyond what the page made itself.
Follows //# sourceMappingURL= (URL or inline base64) and digs into .map sources — often the fastest way to find internal paths and endpoints.
Pulls paths like /api/v2/users, absolute URLs, protocol-relative //host/... refs, and bare hostnames out of every script.
20+ patterns: private keys, Discord webhooks, AWS, GitHub, Slack, Stripe, OpenAI, Anthropic, GOCSPX, Telegram, SendGrid, npm, Twilio, JWTs and more.
Re-scans on pushState navigation and whenever new <script> tags are injected, so results stay fresh on React, Vue, Next and Angular apps.
Endpoints and subdomains matching keywords like admin, debug, internal, swagger or token are surfaced in a dedicated section.
Manual, on-demand checks against vendor identity endpoints (GitHub, Slack, Stripe, Mailgun, Discord, Telegram, OpenAI). Never automatic.
Results survive reloads and accumulate across pages of the same app, stored per host in chrome.storage.local.
One-click copy for any value, plus JSON, TXT and Markdown export from the in-page panel.
Add root domains in the options page to widen subdomain collection beyond the current page's own host.
This is exactly what the in-page panel shows after scanning a typical bundle — secrets first, then high-risk and plain endpoints.
Open the panel, hit the severity chips (All / Critical / High / Medium / Low / Info), and use the search box to filter hundreds of findings in seconds. Click any value to copy it.
If the site ships .map files, their sourcesContent often contains the pre-minified app — far richer endpoints and sometimes forgotten secrets.
Every secret's "Verify live" button issues a single read-only call to the vendor's identity endpoint. JWTs can be decoded in place instead.
Every secret is sorted by severity in the panel, the exports, and the popup's top-secrets list.
| Severity | Examples | Badge |
|---|---|---|
| Critical | Private keys, live Discord webhooks | red |
| High | GitHub / OpenAI / Stripe live / Slack / AWS / GOCSPX | red |
| Medium | Test keys, Telegram / SendGrid / npm / Twilio, bearer tokens, generic assignments | amber |
| Low | Google browser API keys (usually designed to be client-exposed) | cyan |
| Info | JWTs (decode in place) | cyan |
One codebase, two manifests. The JavaScript is identical — a tiny browser alias makes the same files work under browser.* and chrome.*.
| Chrome build | Firefox build | |
|---|---|---|
| Background | service_worker | scripts (event page) |
| Manifest extras | minimum_chrome_version | browser_specific_settings.gecko (121+) |
| Install | chrome://extensions → Load unpacked | about:debugging → Load Temporary Add-On |
| Package | …chrome-1.1.0.zip | …firefox-1.1.0.xpi / .zip |
| Permanent install | Optional — Chrome Web Store | Requires signing at addons.mozilla.org |
Grab the latest release, load it as an unpacked/temporary extension, and start recon.
Google ChromeInstall: chrome://extensions → Developer mode → Load unpacked → select the extracted folder.
Mozilla FirefoxInstall: about:debugging → Load Temporary Add-On → select the manifest or xpi. For permanent installs, sign at addons.mozilla.org.
Authorized testing only. JS Recon Extractor is passive — it makes no requests beyond what the page already did — but the secrets it finds are real. Only use it against applications you own or have explicit written authorization to test. Never verify or use a confirmed credential against targets outside your scope.
Expect false positives: detection is regex-based, and some keys (like Google browser API keys) are designed to be client-exposed. A confirmed secret is a critical finding — stop, notify the owner, and never exploit it beyond proof.