JavaScript Analyzer – Burp Suite Extension

Summary

JS Analyzer - Burp Suite Extension by Jensec (https://x.com/_jensec) A powerful Burp Suite extension for JavaScript static analysis. Extracts API endpoints, URLs, secrets, and email addresses from JavaScript files with intelligent noise filtering. The goal is reduce noise as much as possible to ensure the accuracy Features Endpoint Detection - Finds API paths, REST endpoints, OAuth URLs, admin routes - Finds API paths, REST endpoints, OAuth URLs, admin routes URL Extraction - Extracts full URLs including cloud storage (AWS S3, Azure, GCP) - Extracts full URLs including cloud storage (AWS S3, Azure, GCP) Secret Scanning - Detects API keys, tokens, credentials (AWS, Stripe, GitHub, Slack, JWT, etc.) - Detects API keys, tokens, credentials (AWS, Stripe, GitHub, Slack, JWT, etc.) Email Extraction - Finds email addresses in JS code - Finds email addresses in JS code File Detection - Detects references to sensitive files (.sql, .csv, .bak, .env, .pdf, etc.) - Detects references to sensitive files (.sql, .csv, .bak, .env, .pdf, etc.) Smart Filtering - Removes noise from XML namespaces, module imports, build artifacts - Removes noise from XML namespaces, module imports, build artifacts Source Tracking - Shows which JS file each finding came from - Shows which JS file each finding came from Live Search - Filter results in real-time - Filter results in real-time Copy Function - Copy individual or all findings to clipboard - Copy individual or all findings to clipboard JSON Export - Export all findings to JSON file Installation Download Jython standalone JAR In Burp Suite: Extensions > Extensions-Settings > Python Environment Set the Jython JAR path Extensions > Installed > Add Select Python and browse to js_analyzer.py Usage Browse websites with your browser proxied through Burp Suite Right-click on any raw(s) containing JS response in (either of following tabs): Proxy > HTTP history Target > Site map Repeater Select "Analyze JS with JS Analyzer" Check the JS Analyzer tab for...