Hunt Spa API
Discover a single-page-app's hidden backend API from its public JS bundle, then test...
Install
npx skills add Zyrexnn/Cybermes --skill hunt-spa-api -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Testing
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 1,826 tokens
- Runs scripts
- No, instructions only
What it does
Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon, SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of "Criticals" completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an "app"/"console"/"dashboard"/"portal" subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.
When to use this skill
Trigger when:
- A target host returns a tiny HTML shell + big
/static/js/*.jsor/_next/static/*bundles (React/Vue/Angular/Next/Svelte SPA) - You see a subdomain named
console,app,dashboard,portal,admin,panel,manage,internal - Recon surfaces any
*api*,*-api*,api.*host - A login page is OAuth/SSO-gated (the frontend auth tells you nothing about whether the API enforces auth)
The core insight: a SPA is a client to a backend API, and it ships the full map of that API, hosts, routes, sometimes keys, to anyone who views source. The login page being protected says nothing about whether the API behind it checks tokens. Auth is frequently enforced on the gateway/login and missing on a route group of the API.
DO NOT skip this because "the app needs login", that's exactly when this pays off.
The play (5 steps)
1. Pull the shell + enumerate the bundles
curl -s https://console.target.com/ -o index.html
# React/CRA:
grep -oE '/static/js/[^"]+\.js' index.html
# Next.js:
grep -oE '/_next/static/[^"]+\.js' index.html
# generic:
grep -oiE 'src="[^"]+\.js[^"]*"' index.html
Download every bundle (they can be multi-MB, that's fine, it's all route data):
mkdir bundles
for j in $(grep -oE '/static/js/[^"]+\.js' index.html | sort -u); do
curl -s "https://console.target.com$j" -o "bundles/$(echo "$j"|tr '/' '_')"
done
