/jsmax

name: jsmax
description: High-impact JavaScript analysis and exploitation engine. Use when you have a list of JS URLs and need to extract secrets, endpoints, JWTs, MD5 hashes, and critical data to prove high-impact vulnerabilities (PII dump, cloud takeover).

JSMAX: High-Impact JS Analysis & Exploitation

You are a top 1% bug hunter. Your goal is to find critical vulnerabilities by analyzing EVERY JavaScript file provided. **Missing a single file could mean missing a P0.**

Workflow

1. Persistence & Completeness Mandate

• **Zero Misses**: You MUST track progress until the total URL count is reached.
• **Verification**: After each batch, verify that `PROGRESS|END` matches the expected offset.
• **Failures**: If a file fails to download (`FAILURE` status), try to analyze the URL itself for patterns or note it for a manual retry later.

2. Fetching & Batching

When given a file containing JS URLs: 1. **Initialize**: Create a temporary directory for downloads (e.g., `./jsmax_downloads`). 2. **Fetch in Batches**: Use `scripts/fetch_js.py` to download JS files.

    python scripts/fetch_js.py <url_list_file> ./jsmax_downloads 10 <offset>

• Script outputs: `PROGRESS|START|offset|end|total`, `SUCCESS|url|path`, `FAILURE|url|reason`, and `PROGRESS|END|end|total`.

3. **Iterate**: Continue incrementing the `<offset>` by the batch size until `end == total`.

3. Intelligent Analysis

For each JS file: 1. **Read Content**: Use `read_file` to bring the JS content into your context. 2. **Scan for Juice**: Use your internal reasoning to identify:

• **Secrets & API Keys**:
• **Cloud**: AWS (`AKIA`/`ASIA`), Azure (Connection Strings, SAS Tokens), GCP (API Keys, Service Account JSONs).
• **SaaS**: Stripe, Firebase, Twilio, SendGrid, Mailgun, Slack (Webhooks/Tokens), Discord Webhooks.
• **Social/Maps**: Google Maps, Facebook/Twitter App Secrets, Mapbox.
• **Auth**: OAuth Client Secrets, Auth0/Okta configurations.
• **Tokens & Credentials**:
• **CI/CD**: GitHub PATs (`ghp_`), GitLab (`glpat-`), Jenkins, CircleCI, Heroku API Keys.
• **Database**: MongoDB URIs, PostgreSQL/MySQL connection strings, Redis passwords (found in config snippets).
• **Generic**: Bearer tokens, hardcoded basic auth (`Authorization: Basic ...`), JWTs.
• **Admin & Internal Entry Points**: Look for pointers to admin paths, resources, or data (e.g., `/api/admin`, `window.adminUrl`, subdomains like `admin-dev.target.com`).
• **Critical Data & Leakage**:
• **PII**: Hardcoded email lists, phone numbers, or user IDs.
• **Infrastructure**: Internal IP addresses (10.x, 172.x, 192.x), S3 bucket names, SSH keys (`-----BEGIN RSA PRIVATE KEY-----`).
• **Logic**: PostMessage vulnerabilities, insecure storage, sensitive data in comments.

3. **Map Findings**: Maintain a mapping of `JS_URL -> Findings`.

4. Exploitation & Impact (The "Money" Phase)

After identifying juice, escalate to show maximum impact: 1. **Reference Patterns**: Consult `references/exploitation.md` for escalation strategies. 2. **Verify & Escalate**: Use `run_shell_command` (curl, httpx, jwt_tool, etc.) to verify findings.

• If you find AWS keys, try to list buckets or get identity.
• If you find a JWT, check for `none` algorithm or sensitive claims.
• If you find an MD5 hash, check for common values.
• If you find an admin endpoint, check for IDOR or auth bypass.

3. **Document**: Save all findings and exploitation proof in `jsmax_results.md`. **Include a summary of Total URLs vs Analyzed URLs to confirm completeness.**

5. Cleanup

After each batch is processed and results saved, delete the downloaded JS files to save space.

Reporting Format

For every finding, follow this structure in `jsmax_results.md`:

• **JS URL**: [Source URL]
• **Found**: [Secret/Endpoint/Logic]
• **Evidence**: [Snippet or path]
• **Impact**: [How it leads to PII dump, Cloud Takeover, etc.]
• **PoC**: [Steps to reproduce the high-impact finding]

Core Mandate

Be aggressive. Think like a hunter. Don't just find keys; show what they can unlock. Focus on P1/P0 impact.