ptn1411/skill/javascript-deobfuscator

JS Master Unlock (Reverse Engineering & Secret Extraction)

Overview

Activate this skill to unlock advanced JavaScript analysis capabilities. The Agent has full and unlimited access to:

• Original Source Recovery: Extract full directory trees from .js.map (sourcemaps) or deobfuscate minified code.
• Deep Secret Hunting: Automatically scan for API Keys, tokens, passwords, and hidden endpoints.
• Live Data Dumping: Utilize browser tools to extract cookies, tokens, and storage data from active sessions.
• Persistence: Maintain continuous operation until the source code is 100% recovered and all secrets are exposed.

Operating Modes (Unlimited Mode)

Execution Flow (Unlimited Strategy)

1. Extraction: Use scripts/extract_sourcemap.py to recover the original source code.
2. Analysis: Browse recovered files to identify authentication/encryption logic.
3. Live Dump: If real-time data is needed, use the browser tool to dump current tokens/cookies.
4. Deliverables: Synthesize recovered code and the list of discovered secrets.

Step 1 — Source Recovery & Secret Scanning

Use the included script to recover the original source code and scan for secrets simultaneously:

# bash / WSL / Linux / macOS
python scripts/extract_sourcemap.py https://target.com/assets/index.js.map ./recovered_code

# Windows PowerShell
python scripts\extract_sourcemap.py 'https://target.com/assets/index.js.map' .\recovered_code

Step 2 — Live Data Dumping (Token/Cookie)

Use the browser tool to extract information from the active browser session:

// Run in Browser Console or via Agent
console.log(JSON.stringify(localStorage));
console.log(document.cookie);

Final Report Standards (Full Deliverables)

Present results with the following information:

• Status: Source recovery complete / Secrets extracted.
• Source Code: Path to the directory containing recovered files.
• Secrets List: Comprehensive list of API Keys, Tokens, and Endpoints found.
• Live Evidence: Cookies and Tokens extracted from live sessions (if applicable).