There is a line that separates a tool operator from a tester. The tool operator points sqlmap, nuclei, or Burp's scanner at a target and reports what they say. The tester does that too — but when the tool finds nothing, or the task is to send one custom request a hundred times with a single parameter changing each time, the tester writes ten lines of code and answers the question the tool could not.
Two skills create that line, and this lesson teaches both:
- Reading code you did not write. Modern apps ship a lot of logic to the browser. The JavaScript bundle is the closest thing to source code you get for a black-box target — it holds route definitions, API endpoint strings, client-side checks, and sometimes hardcoded secrets. Reading it is reconnaissance.
- Writing automation. Almost every interesting finding involves repetition: enumerating IDs, fuzzing a parameter, replaying a request with a tweak. A short script does in seconds what is slow and error-prone by hand — and it is reproducible.
This is a foundations lesson, not an exploitation walkthrough. The goal is not to make you a software engineer; it is to make you fluent enough to read the code in front of you and write the small scripts that turn a manual, repetitive task into one command.
In this lesson you will:
- See why reading code (especially JavaScript) is both recon and the key to client-side vulnerability classes like DOM XSS and prototype pollution.
- Learn **Python
requests** — loops, JSON parsing, and sessions — for automating enumeration and fuzzing. - Learn **Bash
for/whileloops** for quick repetition around acurlcommand. - Pick up regex basics for extracting endpoints, emails, and tokens out of text.
- Use JS Recon to inspect the preloaded JavaScript bundle and find a route or endpoint string, then write a **Python
requestsloop with help from Scripts and Reference**.
Prerequisites: python-primer (for requests and loops) and bash-scripting-primer (for for/while loops and curl). The python-primer lesson also introduced what a web application, an API, and HTTP are — those concepts carry directly into this lesson.
Hands-on environment: JS Recon contains the bundle-search workflow, Scripts and Reference explain the code, and Terminal simulates its output. Everything stays in the custom lesson panel; no DevTools window, local Python installation, or live target is required.
Estimated time: twelve to fifteen minutes.
When you are ready, send the Continue signal.