BundleBleed
BundleBleed — a knight bleeding JS from a blade

Extract · Analyze · Hack Better

Turn a pile of JS bundles into leads worth testing.

BundleBleed collects a target's client-side JavaScript and rendered pages, extracts candidate API endpoints, secrets, and DOM-XSS-shaped sink/source pairs, then converts raw matches into scored, explainable hypotheses — so a tester spends time verifying high-signal leads, not skimming a flat dump of regex hits.

View on GitHub → Read the Docs
Open source MIT Python 3.12+

57

secret patterns

69

vulnerable libs tracked

3-gate

active-scan authorization

0

exploitation attempts, ever

Most JS recon tools stop at a list of matches.
BundleBleed turns matches into ranked, evidenced hypotheses.

Every AI claim must cite a real scan evidence ID, or it's rejected as a hard failure.

About

Recon that ends in a decision, not a spreadsheet.

The core pipeline needs zero LLM, API key, or third-party account — it collects JS and rendered pages, extracts endpoints/secrets/params/sinks, and scores them with a deterministic, multi-signal engine. An LLM (Anthropic Claude, self-hosted Ollama, or OpenRouter) can optionally be plugged in for endpoint classification, report drafting, and attack-chain discovery — but it never decides scope, sends a request, or closes a finding.

01

Collect

Passive sources by default; active crawling opt-in behind three gates

02

Extract

Endpoints, secrets, params, and vuln shapes from real JS syntax

03

Score

Multi-factor confidence engine turns matches into Hypotheses

04

Verify

Drafts a test; only a human ever fires the request

05

Report

JSON, Markdown, HTML dashboard, and testing wordlists

Features

What it actually does, end to end.

Collection

Collection & scope

Scope via a single domain, a target list with wildcards/exclusions, or a full scope.yaml (rate limits, authorization attestation, sessions). Passive collection through gau, waybackurls, waymore, paramspider, and urlfinder; active crawling via katana is gated behind a config flag, a CLI flag, and a signed authorization attestation. --seed-url injects known URLs for fresh, JS-heavy SPA targets with no archive history. Every URL from any source is re-validated through ScopeGuard, with an audit-log row per decision.

Extraction

Endpoints, secrets & vuln shapes

Candidate API endpoints from routes, fetch/axios/XHR/GraphQL/WebSocket calls, and forms — with optional AST-based extraction via jsluice for real JS syntax, not just regex. 57 secret patterns across cloud, payment, messaging, AI/LLM, and SaaS providers, always redacted to type + preview + partial hash. Higher-severity shapes: SSRF params, prototype pollution, JWT alg:none, CORS misconfig, open Firebase DBs, exposed .git/.env, and 69 known-vulnerable libraries matched against a pinned retire.js database.

Scoring

Hypothesis engine

A finding only becomes a scored Hypothesis when it matches a known vulnerability shape. Confidence blends static pattern match, JS-body-only visibility, authenticated-context, historical cross-scan repetition, runtime-confirmed evidence, and a capped AI contribution — never AI alone. Optional authenticated crawling and headless-browser runtime capture feed the scorer with real, rendered behavior.

Human gate

Verification, always human-fired

IDOR hypotheses get a drafted .http/curl test with placeholder cookies. Hardcoded-credential hypotheses get a KeyHacks-style liveness command for ~25 secret types — the tool never stores or sends the raw credential. Subdomain-takeover checks resolve CNAMEs via DNS only, never contacting the target. The tool never sends the drafted request itself; only a human, via verify record, changes a hypothesis's status.

AI layer

AI-powered analysis, on a leash

Optional endpoint classification, ai report to draft a human-readable writeup from a hypothesis's redacted evidence, and ai chains to surface plausible multi-step attack chains. Provider-agnostic — Anthropic Claude, self-hosted Ollama, or OpenRouter. Every AI claim must cite a real evidence ID; a hallucinated citation is a hard failure, not a warning.

Reporting

Reports built for the next step

JSON, Markdown, and a self-contained HTML dashboard — no CDN, works over file://, sortable and filterable. Plain-text wordlists for URLs, endpoints, parameters, subdomains, and third-party hosts, ready to feed ffuf, httpx, Burp Intruder, or nuclei. Optional scan history and diffing across runs, with silent webhook alerts only when something actually changed.

Safety model

Built for scoped, authorized testing — not exploitation.

Every guarantee below is enforced in the code, not left to a flag someone forgot to check.

Guarantee What it means
No exploitation, everNot a config option — there is no code path that exploits anything.
Scope-gated by constructionEvery outbound request passes through one ScopeGuard choke point, with an audit-log row per decision.
Passive by defaultActive scanning needs a config flag, a CLI flag, and a signed scope.yaml attestation — all three.
AI has no authorityIt classifies and drafts only. A hallucinated citation is a hard failure, not a soft warning.
Evidence is data, never instructionScanned content is treated as attacker-controlled and is never obeyed.
A human approves everything outboundVerification requests, reports, and alerts are all drafted — only a human sends.
Secrets redacted at ingestType, preview, and a partial hash only — the raw value is never written to disk.

It never automates login, never decides scope, never fuzzes or brute-forces, and never writes (POST/PUT/DELETE) to a target under any flag.

Get started

Install, scan, and read the wordlists.

Requires Python 3.12+ and uv. Every command supports -h / --help.

install & first scan
$ git clone https://github.com/shaikarifali/bundlebleed && cd bundlebleed $ uv sync # single-domain, passive-only scan with drafted verification tests $ uv run bundlebleed scan -t example.com -o results/ --draft-verification # optional: bring your own LLM for classification and report drafting $ uv run bundlebleed scan -t example.com -o results/ --ai --ai-model claude-opus-5
Command What it does
bundlebleed scanCollect, extract, and score a target into ranked hypotheses.
bundlebleed monitorRe-scan on an interval and alert only when access control, secrets, or endpoint shape actually regress.
bundlebleed scope check / listValidate a single URL against scope, or print the fully resolved scope and exclusions.
bundlebleed verify diff / recordCompare two captured responses locally, then record a human-confirmed outcome — the only way a hypothesis's status changes.
bundlebleed ai report / chainsDraft a writeup from scored evidence, or surface plausible multi-step attack chains — pure analysis, nothing sent.
bundlebleed export openapiEmit a valid OpenAPI 3.0 document from collected endpoint findings — no network activity.

Full flag reference and the detection-pattern catalog live in docs/ in the repository.

Speaking

The UI Is the Lie: Hunting Bugs Hidden in JavaScript Bundles

A talk at null Hyderabad on why the rendered UI hides the real attack surface, and how to pull endpoints, secrets, and DOM-XSS-shaped sinks straight out of a target's JS bundles — the ideas that became BundleBleed.

View session on nullHyd →
Shaik Arif Ali presenting "The UI Is the Lie" — a talk on hunting bugs hidden in JavaScript bundles, with the BundleBleed logo projected behind him