Introduction

Welcome to the official documentation for js-recon, a powerful tool for JavaScript reconnaissance. This documentation provides a comprehensive overview of all available commands and their functionalities.

Available commands

js-recon offers the following commands to help you analyze and extract valuable information from JavaScript files:

• Lazyload: Download all Lazy-Loaded JavaScript files from a target URL or a list of URLs.
• Endpoints: Extract client-side from JavaScript files.
• Strings: Extract strings, URLs, and secrets from JavaScript files.
• Proxy: Route outbound requests through AWS API Gateway (IP rotation), a SOCKS5/HTTP proxy, or Oxylabs datacenter proxies.
• Map: Map and analyze functions within JavaScript files. For Next.js, an interactive mode is also available.
• Run: Run essential modules automatically.
• Report: Generate an HTML report of the reconnaissance results.
• Analyze: Analyze the JS files using the js-recon-rules.
• Refactor: Refactor the JS Chunks into separate files.
• Load: Populate the response cache from a Caido export so later runs can be executed offline with --cache-only.
• Sourcemaps: Extract embedded sourcemaps from downloaded JavaScript files.
• Fingerprint: Detect the JS framework used by a target before running other modules.
• CS-MAST: Generate and compare structural signatures across bundles.
• MCP: Run JS Recon as an MCP server for Claude Code integration.
• Completion: Generate shell completion scripts for js-recon.

Select a command from the list preceding to view its detailed documentation, including all available options and practical examples.

Example scenario

The document here demonstrates an example scenario of using JS Recon with a Next.js app.