jswzl - Features

· PROXY INTegration

Utilize Burp Suite

The jswzl plugin for Burp Suite sends all Javascript that passes through the proxy to the analysis server, and more!

Feature ·

fingerprint

Fetches sourcemaps

Sourcemaps allows us to see the original source code if they exist. jswzl attempts to fetch a `.map` file for every Javascript file requested.

Feature ·

fingerprint

Fetch packed chunks

Chunks are often only loaded on demand. Using a sandbox, jswzl discovers and pre-fetches all chunks.

· Pre-analysis

fingerprint

Source Pre-analysis

Applies source maps to the source code

Any source maps present is applied to the code, and any packed code is unpacked into their own files for analysis.

Extract packed code

Packed sources are extracted into their individual files, allowing you to see the original structure of the code.

· optimization

Advanced Tree Optimizations

check

Step

Resolve references

Using a custom Javascript interpreter, the tree is walked and references are resolved.

check

Improved semantic understanding for the analysis engine.

check

Improved user experience when reading the code, better showing the intent of the code.

check

Step

Iterative optimization process

jswzl has a library of optimizers which transforms the code to better show intent, and undoing certain minification to improve semantic clarity.

Example: Collapsing string operations

fingerprint

var apiHost = "https://api.example.com";

var apiBasePath = "api/";

var requestPath = `{apiHost}{apiBasePath}` + "v1/".concat("users");

var requestPath = `https://api.example.com/api/v1/users`;

check

Step

Code is prettified

The code is prettified, making it easier to read for a human.

fingerprint

if (isValid(input)) { process(input); } else { showError(); }

if (isValid(input)) {

process(input);

} else {

showError();

);

- DESCRIptors

fingerprint

Extract Descriptors from code

The code is annotated with Descriptors, describing the constituent parts of the code relevant to testers.

api/users/1

/scripts/main.js

rest/v1/admin/info

String Expressions

Find paths, secrets, GraphQL queries, and other pertinent text content.

const httpOptions = {

method: 'POST',

headers: {

'api-key': 'secret'

}

String Expressions

Find paths, secrets, GraphQL queries, and other pertinent text content.

const resp = await fetch(

url,

httpOptions

);

String Expressions

Find paths, secrets, GraphQL queries, and other pertinent text content.

Features

Utilize Burp Suite

Fetches sourcemaps

Fetch packed chunks

Source Pre-analysis

Applies source maps to the source code

Extract packed code

Advanced Tree Optimizations

Resolve references

Iterative optimization process

Example: Collapsing string operations

Code is prettified

Extract Descriptors from code

String Expressions

String Expressions

String Expressions

Features

Help

Company

jswzl aps