Bug › Module 5 › Lesson 2
JS and APIs
JavaScript bundles and API routes reveal surface area — review only on in-scope $SCOPE_HOST assets.
Visual · bounty_js_and_apis
JS and API literacy. $SCOPE_HOST only. Original Cyberlium.
Opening
JS files name endpoints — scope decides whether you fetch them.
Modern apps expose attack surface in JavaScript bundles and API routes: hidden endpoints, GraphQL paths, hardcoded keys (report responsibly), and parameter names. Bounty hunters review JS and API docs on in-scope $SCOPE_HOST hosts at policy rates — literacy means reading structure, not spraying unauthorized requests on strangers. Cyberlium teaches JS/API mapping concepts without fetching classmate bundle URLs or third-party CDN code outside scope. Next: Params and Roles.
1. JavaScript review on in-scope apps
Fetch and read bundles from $SCOPE_HOST pages you are authorized to test. Extract endpoint paths, parameter names, and feature flags for inventory rows. Minimize requests — respect rate limits.
Third-party analytics scripts are usually out of scope — note vendor, do not deep test without listing.
Command guide
Try these commands — JavaScript review on in-scope apps
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Live host probing — httpx on hosts.txt from subfinder Asset mapping — status + title columns
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest sudo apt install jq
macOS:
Command — copy this
brew install httpx brew install jq
Windows:
Command — copy this
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest choco install jq
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" httpx -l "$HOME/cyberlium-lab/t20-hosts.txt" -status-code -title 2>/dev/null | head -15 || curl -sS "https://$SCOPE_HOST/get" | jq '.headers.Host'
Primary tools to practice this lesson: httpx, jq. Reference sites: Live host probing; Asset mapping. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. API mapping literacy
OpenAPI/Swagger docs on in-scope hosts, /api/ path patterns, GraphQL introspection if policy allows — each finding gets an inventory row with auth requirements.
API fuzzing on out-of-scope payment or auth providers is a report rejection and account risk — not bounty prep.
3. Secrets in JS — report, do not exfiltrate
If a bundle exposes a key on $SCOPE_HOST, note minimal proof per program rules — do not download excessive data or reuse keys on other hosts.
Ship: JS/API review checklist for $SCOPE_HOST rows. Next: Params and Roles.
4. What you ship: JS/API review checklist for $SCOPE_HOST
Checklist: bundle source, endpoints extracted, in-scope confirmed, rate limit noted. $SCOPE_HOST only. chmod 600.
5. What you record before the next lesson
Date. JS/API checklist. $SCOPE_HOST named. File t20-m05-l02-js-and-apis.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Fetch JS from classmate deploy. Exfiltrate user data from API 'to map params.'
Right
Write JS/API checklist for $SCOPE_HOST inventory rows. Next: Params and Roles.
Mission: draft JS/API review checklist
1) List review steps for in-scope bundles. 2) Note third-party script handling. 3) chmod 600. Never fetch JS from out-of-scope hosts.
Stuck? Ask Cyberlium AI Mentor
JS maps surface — scope maps permission.
Knowledge Check
APPLY: JS bundle review in Cyberlium applies to:
Multiple choice
Knowledge Check
APPLY: True or False: Third-party analytics scripts are usually in scope for deep testing.
True or False
Knowledge Check
APPLY: API endpoint found in $SCOPE_HOST JS should:
Multiple choice