0009779: JS-Recon - specialized enumeration and SAST tool for JS frameworks (blackbox) - Kali Linux Bug Tracker

ID	Project	Category	View Status	Date Submitted	Last Update

0009779	Kali Linux	Queued Tool Addition	public	2026-07-10 08:39	2026-07-31 15:09

Reporter	shriyanss	Assigned To
Priority	high	Severity	minor	Reproducibility	have not tried
Status	acknowledged	Resolution	open

Summary	0009779: JS-Recon - specialized enumeration and SAST tool for JS frameworks (blackbox)
Description	Tool Name: JS Recon Tool Version: 1.3.1 Homepage: https://github.com/js-recon/js-recon Author: Shriyans Sudhi (@shriyanss/@ss0x00) License: MIT (Short) Description: JS enumeration and SAST (Long) Description: JS Recon is a tool specialized to discover and analyze JavaScript files from websites running JS frameworks like Next.js, React, Vue, Nuxt, Svelte, etc. It performs better than traditional crawlers on JS apps as it utilizes more than simply following script tags. In addition to downloading JS files, it has a built-in SAST engine to work on bundled JS. For context, existing SAST scanners, like CodeQL and Semgrep, are meant to be run on development code, while JS Recon is built to work in a black-box environment. Dependencies: Node.js and Puppeteer are required. Trufflehog is an optional addition. Similar Tools: JSluice, Katana, LinkFinder, etc. Activity Started in Aug 2025 I (shriyanss) am working full-time on this tool and will continue. My work includes two major areas: Research: Finding new blackbox techniques. Currently, I'm working on recovering the source of the application using bundled JS (prototype is up on the alpha versions of the tool) Engineering: Ensuring the tool works as expected, publishing on several platforms, etc. The tool is also used manually on live targets (although the primary task is to just test the tool, it did manage to find 3-4 crits in the past month) A research paper describing the tactics used in the tool is conditionally accepted at IEEE/ACM ASE 2026 (to be published in a month or two) How to install The docs can be found at https://js-recon.io/docs/docs/installation The primary method is to install using `npm i -g @shriyanss/js-recon@latest`. For Kali, the bundled code for JS Recon can be shipped, which can be run directly by the user How to use The quick-start, and the only required command in most cases, is: `js-recon run -u <url> -y -k` `-y`: Allow code execution (required in reconstruction) `-k`: Ignore SSL cert The full docs for this command is available at https://jsr.rip/run Currently, there are 10+ modules which can be invoked manually for specific use cases (like generating a wordlist, using AWS to bypass firewall, navigate the bundled JavaScript, or manually run JS Recon rules on downloaded JS). Docs at https://jsr.rip/modules JS Recon Rules: Inspired by Nuclei templates. YAML-based rule files for vulenrability detection, like DOM XSS, Cookie Manipulation, etc. Packaged It is not available as binary/packaged for debian yet. Rather, the script can be run using `node`.

shriyanss 2026-07-23 13:35 reporter ~0021897	Quick update on the tool: I recently migrated the tool from my personal namespace to the `js-recon` namespace on GitHub and NPM. Because of this: The new latest stable version is `1.3.2` (also, a new stable release is expected next week) Standard installation method changed from my personal NPM `js-recon` organization: `npm i -g @js-recon/js-recon@latest` Everything else remains the same.

g0tmi1k 2026-07-31 15:09 administrator ~0021913	@kali-team, please could this be packaged up. @author, If you want to help the packaging process, you can check the documentation here: https://www.kali.org/docs/development/setting-up-packaging-system/ https://www.kali.org/docs/development/intro-to-packaging-example/ https://www.kali.org/docs/development/intermediate-packaging-example/ https://www.kali.org/docs/development/advanced-packaging-example/ https://www.kali.org/docs/development/rebuilding-a-package-from-source/ https://www.kali.org/docs/development/packaging-apps-with-kaboxer/

Date Modified	Username	Field	Change
2026-07-10 08:39	shriyanss	New Issue
2026-07-21 08:48	daniruiz	Summary	JS Recon - specialized enumeration and SAST tool for JS frameworks (blackbox) => JS-Recon - specialized enumeration and SAST tool for JS frameworks (blackbox)
2026-07-21 08:48	daniruiz	Description Updated
2026-07-23 13:35	shriyanss	Note Added: 0021897
2026-07-31 15:07	g0tmi1k	View Status	private => public
2026-07-31 15:09	g0tmi1k	Priority	normal => high
2026-07-31 15:09	g0tmi1k	Status	new => acknowledged
2026-07-31 15:09	g0tmi1k	Category	New Tool Requests => Queued Tool Addition
2026-07-31 15:09	g0tmi1k	Note Added: 0021913