____ _ _ _ ____ / ___| |__ ___ ___| |_ | / ___| | | _| '_ \ / _ \/ __| __| | \___ \ | |_| | | | | (_) \__ \ |_ _| |___) | \____|_| |_|\___/|___/\__(_)_|____/
made by lazy_sharaf
Modern web applications heavily rely on massive, obfuscated JavaScript bundles. Often, developers inadvertently leak highly sensitive infrastructure data inside these files. I built GhostJS to automate the tedious and manual process of web crawling and JavaScript analysis so researchers can instantly hunt for critical AWS keys, database connection strings, and exposed APIs across massive target scopes.
GhostJS operates as a command-line tool built in Python. It recursively crawls domains using depth-configurable multi-threading. As it extracts target JavaScript files, it applies a layered analysis approach. First, it uses an extensive dictionary of high-fidelity Regular Expressions. Second, it calculates the mathematical entropy of random-looking strings to flag highly probable encoded secrets (like JWTs) that regex misses.
A massive hurdle when scanning bundled Javascript is the staggering amount of "false positives" —
completely benign random strings that trigger alerts. I combated this by carefully balancing my
Regex
sets to target specific developer key formats (e.g. AKIA... for AWS) and adjusting the
mathematical entropy thresholds to quickly weed out harmless hashes from high-value production
secrets.