JSParser

A python script using Tornado and JSBeautifier to parse relative URLs from JavaScript files. Useful for easily discovering AJAX requests when performing security research or bug bounty hunting.

This is a fork of JSParser that supports Python 3.

Dependencies

• safeurl
• tornado
• jsbeautifier

Installing

$ pip install .

Running

Run handler.py and then visit http://localhost:8008.

$ python handler.py

With uv, you can directly run:

$ uv run handler.py

Authors

• https://twitter.com/bbuerhaus/
• https://twitter.com/nahamsec/

Inspired By

• https://twitter.com/jobertabma/

References

• http://buer.haus/2017/03/31/airbnb-web-to-app-phone-notification-idor-to-view-everyones-airbnb-messages/
• http://buer.haus/2017/03/09/airbnb-chaining-third-party-open-redirect-into-server-side-request-forgery-ssrf-via-liveperson-chat/

Changelog

1.0 - Release