inventory-javascript-mapper

Inventory JavaScript Mapper

Discover client-side routes, SPA pages, and JavaScript-only content using Playwright headless browser automation. Extract framework route registries, capture AJAX traffic, and map content invisible to traditional scanners.

Workflow

Phase 1: Recon

1. Mount skill file:

   Read plugins/pentest/skills/web-application-mapping/SKILL.md
   

2. Navigate to the target and capture initial DOM state:

   browser_navigate(url="https://TARGET")
   browser_snapshot()
   

3. Capture initial network requests on page load to identify AJAX endpoints:

   browser_network_requests()
   

4. Take an initial screenshot for reference:

   browser_take_screenshot(filename="outputs/ENGAGEMENT/activity/js-mapper-initial.png")
   

5. Detect JavaScript framework from DOM signals:

   browser_evaluate(function="() => JSON.stringify({ react: !!(window.React || document.querySelector('[data-reactroot]')), vue: !!(window.Vue || document.querySelector('[data-v-]')), angular: !!(window.ng || document.querySelector('[ng-version]')), next: !!(window.__NEXT_DATA__), nuxt: !!(window.__NUXT__) })")
   

6. Extract page title and any framework version hints:

   browser_evaluate(function="() => document.title")
   browser_evaluate(function="() => window.__NEXT_DATA__ ? JSON.stringify(Object.keys(window.__NEXT_DATA__)) : 'not-next'")
   

7. Log:

   {"timestamp":"...","agent":"inventory-javascript-mapper","action":"recon","target":"https://TARGET","framework":"react","spa":true,"initial_ajax_calls":7}
   

Phase 2: Experiment

Attempt to extract the full route list from the detected framework's route registry:

React Router:

browser_evaluate(function="() => { try { return JSON.stringify(window.__reactRouterContext?.router?.routes || window.__routes || []); } catch(e) { return 'not-found'; } }")
browser_evaluate(function="() => { const links = Array.from(document.querySelectorAll('a[href]')).map(a => a.getAttribute('href')).filter(h => h && h.startsWith('/')); return JSON.stringify([...new Set(links)]); }")