JavaScript Is a Recon Goldmine
A six-step workflow for JavaScript recon on pentests and bug bounty, plus a checklist for developers on what not to ship in front-end code.
home / research
// writeups · methodology · research
Research & writeups
Methodology notes and writeups from the SecureDX team. Everything here is public.
JavaScript Is a Recon Goldmine, Part 2: Advanced Techniques
What to do when grep and a crawler aren't enough: route manifests, recovering every webpack chunk, parsing calls with Babel, recording traffic per role, and diffing static against runtime.
JavaScript Is a Recon Goldmine, Part 3: Automating the Pipeline
Four small scripts and one SQLite file per target: collect, extract, remember, alert, and hand yourself a ranked list of routes to test by hand.
Recon Is Where Bugs Are Found
A five-stage recon pipeline for pentests and bug bounty, with commands for each stage and a checklist of what to look at once the output lands.
Recon Is Where Bugs Are Found, Part 2: Advanced Recon for 2027
What to do after subfinder, httpx and ffuf: organisation mapping, CDN origins, code leaks, deep JavaScript, exposed AI and MCP servers, and continuous recon.
Recon Is Where Bugs Are Found, Part 3: Recon for Defenders
How defenders use the same recon attackers run: inventory what you own, alert on change, fix the common exposures, publish a disclosure policy, and follow a 30-day plan.