BurpJSLinkFinder Enhanced - Link & Sensitive Data Finder

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/panchocosil/burp-js-linkfinder-enhanced
• Blog Title: BurpJSLinkFinder Enhanced - Link & Sensitive Data Finder
• Suggested Section: 🕸️ Pentesting Web -> (Recon/JS analysis) add under a new or existing subsection like "JavaScript analysis / endpoint discovery" (alternatively: "80,443 - Pentesting Web Methodology" as a tooling note)

🎯 Content Summary

What this project is

BurpJSLinkFinder Enhanced - Link & Sensitive Data Finder is an enhanced Burp Suite extension (Python/Jython) that performs passive analysis of JavaScript responses to extract:

• Links/endpoints (API routes, URLs, file references, handlers)
• Sensitive data embedded in JavaScript (credentials/tokens/keys/secrets)

It is an enhanced version of the origi...

🔧 Technical Details

Passive JavaScript endpoint mining: Intercept/observe JavaScript responses (not only .js files—also match by MIME types such as application/javascript, text/javascript, and Burp’s script, plus paths ending in /js) and apply link-extraction regexes to recover hidden attack surface: absolute URLs, relative paths (e.g., /api/users, ../config.json), file references (e.g., config.php), and handler patterns including .ashx and extensionless endpoints (e.g., Handler?param=value). Include ES6 template literal (backtick) parsing to catch endpoints embedded in template strings.

Client-side secret harvesting via pattern matching: Treat JavaScript as a common secret-leak source and scan it for credential material using targeted patterns: explicitly-named API keys (api_key/apikey/apiKey), J...

🤖 Agent Actions

Updated the web methodology spidering tool list to include BurpJSLinkFinder Enhanced and added a References section with the blog URL.

Files modified

• src/network-services-pentesting/pentesting-web/README.md

Tests not run (not requested).

If you want, I can also add a short “JS secret hunting” sub‑note under the JS files bullet in the same page.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/panchocosil/burp-js-linkfinder-enhanced

Content Categories: Based on the analysis, this content was categorized under "🕸️ Pentesting Web -> (Recon/JS analysis) add under a new or existing subsection like "JavaScript analysis / endpoint discovery" (alternatively: "80,443 - Pentesting Web Methodology" as a tooling note)".

Repository Maintenance:

• MD Files Formatting: 954 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0