Extract endpoints and secrets from JavaScript bundles

Aug 8, 2026 · 1 min read

Modern apps ship their whole API map in JS. Pull every script, extract endpoints and parameters, and grep for tokens.

bash

cat urls.txt | grep -E ".js($|?)" | httpx -silent | while read u; do curl -s "$u"; done > all.js
grep -EoR ""/(api|v[0-9])/[a-zA-Z0-9_/-]+"" all.js | sort -u

Recover source structure and hidden keys.

bash

grep -EoR "(AIza[0-9A-Za-z_-]{35}|sk_live_[0-9A-Za-z]+|AKIA[0-9A-Z]{16})" all.js
# if a .map exists, unpack original sources
npx source-map-explorer bundle.js bundle.js.map

Pro note: source maps left in production give you readable original code, including comments and internal route names. Diff bundles over time (wayback copies) to catch endpoints that were removed from the UI but still work on the server.