jscope 0.4.2__py3-none-any.whl

jscope-0.4.2.dist-info/METADATA

@@ -0,0 +1,180 @@
+Metadata-Version: 2.4
+Name: jscope
+Version: 0.4.2
+Summary: Evidence-based JavaScript intelligence for bug bounty hunters and web app pentesters
+Author: Muhammed Ali
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/LIME1Star/JScope
+Project-URL: Issues, https://github.com/LIME1Star/JScope/issues
+Project-URL: Changelog, https://github.com/LIME1Star/JScope/blob/main/CHANGELOG.md
+Keywords: security,bug-bounty,pentest,javascript,static-analysis,appsec,recon
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: tree-sitter>=0.23
+Requires-Dist: tree-sitter-javascript>=0.23
+Requires-Dist: tree-sitter-typescript>=0.23
+Requires-Dist: requests>=2.31
+Requires-Dist: beautifulsoup4>=4.12
+Provides-Extra: yaml
+Requires-Dist: PyYAML>=6.0; extra == "yaml"
+Provides-Extra: browser
+Requires-Dist: playwright>=1.40; extra == "browser"
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: PyYAML>=6.0; extra == "dev"
+Requires-Dist: build; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Dynamic: license-file
+
+
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark.svg">
+    <img alt="JScope" src="assets/logo-light.svg" width="360">
+  </picture>
+</p>
+
+<p align="center">
+  <b>Evidence-based JavaScript intelligence for bug bounty hunters and web app pentesters.</b><br>
+  Reconstructs how a web app behaves from its JS, and refuses to show a finding it can't justify.
+</p>
+
+<p align="center">
+  <a href="https://github.com/LIME1Star/JScope/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/LIME1Star/JScope/actions/workflows/ci.yml/badge.svg"></a>
+  <img alt="Python 3.10+" src="https://img.shields.io/badge/python-3.10%2B-blue">
+  <img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-green">
+</p>
+
+---
+
+Most JS recon tools hand you a long list of strings. JScope hands you a **map** (routes, components, API calls, guards, roles)
+and a **ranked list of where to start testing**, where every point in the ranking has a stated reason and every finding
+carries the evidence behind it.
+
+```text
+$ jscope analyze tests/sample_react
+
+[where to start testing]  (deterministic ranking; reasons shown)
+   68  [CONFIRMED] JS-0004  endpoint: /api/admin/reports/export
+       test: Request as an unauthenticated / low-privilege user and check for missing access control.
+   58  [CONFIRMED] JS-0001  endpoint: /api/admin/users
+       test: Request as an unauthenticated / low-privilege user and check for missing access control.
+   54  [CONFIRMED] JS-0003  endpoint: /api/users/{id}/profile
+       test: Vary the ID parameter across accounts/sessions and diff authorization results.
+   ...
+
+[route map]  6 route(s)   (R=route G=guard role=declared role E=endpoint)
+  R /                            UNPROTECTED
+      E /api/v1/feed
+  R /admin/reports               UNPROTECTED
+      E /api/admin/reports/export
+  R /login                       UNPROTECTED
+      E /api/auth/login
+  R /admin/users                 guards=RequireAuth roles=admin
+      E /api/admin/users
+  R /billing                     guards=RequireAuth
+      E /api/payments/invoices
+  R /profile                     guards=RequireAuth
+      E /api/users/{id}/profile
+```
+
+An unguarded `/admin/reports` route calling an admin export endpoint is exactly the kind of lead you want surfaced in seconds.
+Try it yourself on the bundled fixture (`tests/sample_react`).
+
+## Install
+
+```bash
+pip install git+https://github.com/LIME1Star/JScope.git
+jscope doctor        # checks your install
+```
+
+Python 3.10+. For YAML OpenAPI specs: `pip install "jscope[yaml] @ git+https://github.com/LIME1Star/JScope.git"`.
+
+## Quick start
+
+```bash
+jscope analyze ./path/to/js-project --verbose      # ranking, route map, evidence appendix
+jscope explain JS-0004 --findings-file f.json      # full evidence chain for one finding
+jscope graph ./project                             # route -> component -> API -> guard map
+jscope https://app.example.com                     # crawl + download + analyze (authorized targets only)
+jscope report f.json --format html -o report.html  # re-render: human | json | markdown | html | sarif
+```
+
+Remote commands (`go`, `scan`, `crawl`, `download`) are bound to the target host, rate-limited, and **refuse loopback/private
+addresses by default**. For controlled local testing pass `--allow-private`.
+
+## What makes it different
+
+| | Typical JS recon | JScope |
+|---|---|---|
+| Method | regex over bundles | tree-sitter AST, constant propagation, dead-branch detection |
+| Output | flat list of URLs / strings | route, guard and role graph with route-to-API attribution |
+| Findings | everything that matches | only evidence-backed candidates, scored deterministically |
+| Triage | you sort it out | ranked "where to start testing", each point explained |
+| Honesty | silent on limits | every finding states what it could *not* resolve |
+
+Tools like LinkFinder, jsluice and SecretFinder are excellent at fast extraction, and JScope is built to sit alongside them,
+adding structure and prioritization on top.
+
+## How it stays honest
+
+```text
+analyzers propose  --->  EvidenceEngine scores + dedups  --->  you see Findings
+   (Candidate)             (deterministic, explainable)           (Finding)
+```
+
+Analyzers can never emit a finding directly, only `Candidate`s backed by typed `Evidence`. That boundary keeps a noisy analyzer
+(including community plugins) from polluting your output. Confidence means "this pattern exists and means what it looks like",
+**not** "this is exploitable"; only the opt-in `confirm` / `verify` steps add runtime evidence. Details:
+[docs/EVIDENCE_SCHEMA.md](docs/EVIDENCE_SCHEMA.md).
+
+## What it analyzes
+
+14 built-in analyzers: routes (React Router, Vue Router, Angular, Next.js), authentication and authorization patterns, storage and
+token handling, GraphQL operations and schemas, OpenAPI specs (correlated both ways with client calls), service workers,
+source maps, HTML forms/CSP/SRI, WASM modules, secrets, endpoints and framework detection.
+
+Also included: workspaces with baseline diffing (`ws-scan`), optional AI explanations that never invent findings
+([docs/AI.md](docs/AI.md)), a plugin system with trust tiers ([docs/PLUGINS.md](docs/PLUGINS.md)), SARIF output for CI, and
+opt-in runtime confirmation and browser observation.
+
+## Status and limitations
+
+JScope is a **beta development tool, not a production scanner.** Be aware of these before relying on it:
+
+- Symbol resolution is a per-file heuristic. There is no cross-file data flow yet, and import resolution handles relative
+  paths only (no `@/` or tsconfig aliases).
+- Client-side authorization findings are observations, not vulnerabilities. A missing guard may live in a layout or on the server.
+- Runtime confirmation is opt-in and narrow: GET/OPTIONS only, allow-listed hosts. It shows a route *responds*, not that it is *vulnerable*.
+- The accuracy benchmark uses 12 synthetic fixtures; a real-world corpus is on the [roadmap](docs/ROADMAP.md).
+- Network scope enforcement is not unified across every component and DNS pinning is not guaranteed on all paths. Read
+  [docs/SECURITY_LIMITATIONS.md](docs/SECURITY_LIMITATIONS.md). Plugins execute arbitrary Python.
+
+**Only test systems you own or are explicitly authorized to assess.**
+
+## Development
+
+```bash
+git clone https://github.com/LIME1Star/JScope && cd JScope
+python -m venv .venv && . .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+python -m jscope benchmark --strict
+```
+
+See [CHANGELOG.md](CHANGELOG.md) for release history and [docs/](docs/) for each subsystem. Issues and pull requests are welcome.
+
+## License
+
+MIT, see [LICENSE](LICENSE).

jscope-0.4.2.dist-info/RECORD

@@ -0,0 +1,81 @@
+jscope/__init__.py,sha256=6hfVa12Q-nXyUEXr6SyKpqPEDJW6vlRHyPxlA27PfTs,22
+jscope/__main__.py,sha256=xXqap1rt7DrRbDGYcWAD7GqUexTx0sKJSjfny9R1vIY,360
+jscope/assessment_engine.py,sha256=ttRUnEN0F-brCyniQGNlqGp4qE6S7jQNLkoJhSAjTkE,12164
+jscope/assessment_reporting.py,sha256=z8bKq-s5r6fBYEFlp3Ok78gzlrTUTJko2crdiBDqLt8,3453
+jscope/cli.py,sha256=Vn_Yf2_grHSMI2Fw19YquZiKYtE_f1Vn3vHvENf7Ocg,64096
+jscope/config.py,sha256=SXNJxB1PjXtwepqe8XG-m4JDSELUlx8txdpFk6b_Pa8,2956
+jscope/passive_discovery.py,sha256=Ch9-3M8sixr5DEFzOsWZJQtGFUA9Zr05ZDmfh7eG3_A,3901
+jscope/pipeline.py,sha256=-ARrOhisI6buVO7eeIXV8JVnebipeII3hVR2SqU-BxQ,10445
+jscope/security_transport.py,sha256=3FECDtBvVQHnWbAQM9qJ8ufW5x1Nr9PBJWle9Qs4sTM,13287
+jscope/ai/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/ai/explain.py,sha256=ZX9BzmAOIatSqHIl3_LLQAna5YkHNeDTCxav5ZiteFg,8121
+jscope/ai/providers.py,sha256=-s1SB6QbCmVmBIKbge8JqnU2KYV-EDhOiA2VghFRnC8,2701
+jscope/analyzers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/analyzers/auth_analyzer.py,sha256=Uloat3fdWL0dddP8x8_eia4LIOI_WSvTQnAItQ1Nzvs,12047
+jscope/analyzers/authorization_analyzer.py,sha256=Xhoka4kHI0UtesBZ95lcQPr0bAXgZvmodxyNtq4sb7w,12824
+jscope/analyzers/base.py,sha256=bKgDAAL595quCP_2cdlKP2M21EMldrhVV0Gg_L0_Ca4,2515
+jscope/analyzers/common.py,sha256=RE4JRQPabEJxcX4byph9qm8tfAc9jrDoLEPuyu0dndo,3116
+jscope/analyzers/dataflow_analyzer.py,sha256=C_K28Vu67_seZXJos2FEIfRNp5wsIZDMzAbie3V8ocA,12094
+jscope/analyzers/endpoint_analyzer.py,sha256=3SFKZYMx49-51T7mZgAICY6kIBU7I9OBGkbpgeow4QI,7064
+jscope/analyzers/framework_detector.py,sha256=DLlVrfq5edu7qaf152An2VU8FUaH019-nO_mcca-954,3704
+jscope/analyzers/graphql_analyzer.py,sha256=bm4qpvh_svjE7adR6Eyk-9DTEdBmuKErddet7uP8QoI,12792
+jscope/analyzers/graphql_schema_analyzer.py,sha256=eB-YklGolngYdhLdQB44M4FiLWrjzQrsj_08uQzDKWM,8740
+jscope/analyzers/html_analyzer.py,sha256=mhjEwfGQjnLAUe-5mkBtBd3LUnq47MfRNY0QiiTQRgI,12613
+jscope/analyzers/manager.py,sha256=2hgUrQZRRoxPzAgX3HLtP4X_4QLZWjRed6Smst94d6M,5275
+jscope/analyzers/openapi_analyzer.py,sha256=g2WibDF86bZO2JWlDN7fYrQmEaOhUY-KkNadRBC4gx4,18117
+jscope/analyzers/router_analyzer.py,sha256=wlw70iePfFFLkSOsS4TZTMChn9a04RU0LeHAY7F4s48,26539
+jscope/analyzers/secret_analyzer.py,sha256=71tsPuWT_OFXATz_3ej0BalsWYBvQj_W0eadOMTwmns,4633
+jscope/analyzers/service_worker_analyzer.py,sha256=NQXAHJPIxOwxYsNitsQdQ5PqmAm56SjxEEpiDKMpB_M,9092
+jscope/analyzers/source_map_analyzer.py,sha256=nbJQwn45yKpzznI0Poa7m7X4LQnrayVrxeBIl9TybhQ,5914
+jscope/analyzers/storage_analyzer.py,sha256=C3WJzRzxHsv8htrpFePvJlxC7NHOpLIoUWFbt-OJDFw,6610
+jscope/analyzers/wasm_analyzer.py,sha256=61amZluwjT9_erd8HS40CbS2FPos2IsMXDkR471r_yM,8467
+jscope/benchmark/__init__.py,sha256=71nTSRIIq4BVGnOc7JIrrYpDNHdb74GSsI0QMaOjsw0,45
+jscope/benchmark/fixtures.py,sha256=tGmqIzSyMGSgDxqHI_jAvskfpBpEbNjy5Xuk84YKD0A,7207
+jscope/benchmark/runner.py,sha256=NomPzyoM4qRfOP1Iml5Rn2hcpN78yrbhspLrv6ZKGRw,6662
+jscope/core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/core/artifacts.py,sha256=kH3nMXzPVvCN_6ZUx1kWIHRwIDLMfRxztu_s3ndCecA,5113
+jscope/core/cache.py,sha256=r5YRVoEJqzAECTmDhuVbV6IsIZ5ONdLMV_WTKQe9j_o,9840
+jscope/core/classification.py,sha256=4CLOxOt6xbv3agJvCjIOScppE4DdWQEPPRSXoI6yS8o,2737
+jscope/core/evidence.py,sha256=CpGyFGA-J2x-HyQDVxr4DI1UhMfgmLokJRyg5cEDE9s,18102
+jscope/core/graph.py,sha256=TFUPNQ7Zn0ku5HJeG9ig61c1ZOjKD5Kfr58MO-DCH4M,8792
+jscope/core/redact.py,sha256=jU4j_S768_fxMvEv7B5BCOy-mnQL3GifgRQ7wWTLAtI,3085
+jscope/crawler/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/crawler/crawler.py,sha256=8oKnRkhlJgC7DiiOJoijIg_mWpVafOYlnKKTJvKGd3o,8026
+jscope/dataflow/__init__.py,sha256=Cgm6c07LHjTEu8_k32li2wQJ8JPvr672HyLpGdwgIWc,94
+jscope/dataflow/engine.py,sha256=AiwPUoci1ANJXTL2nZzcOnw8RR2j-AI90-4LbcTX3hk,82697
+jscope/dataflow/modules.py,sha256=m3LcvYnQhmuojMgmTsEH1qNg4Vqd2VxG11zzm5Bpg44,9000
+jscope/dataflow/rules.py,sha256=BmMz24CW1mYKnTP3yjUfojR7BDL-oZKA0WR33QbKv-8,8166
+jscope/downloader/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/downloader/downloader.py,sha256=uooUDozake49BVEJa6jN7vaQBB70f1NGoSCsl7q9PsE,4449
+jscope/parsing/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/parsing/ast_engine.py,sha256=UcVH_vJmxmLyi5iS-2kv8ta5SRQ8SBat0TQX6BnNqvI,13640
+jscope/parsing/graphql_schema.py,sha256=TqPnAEmivsrsWYBD-gnSh2GvHbfhAmCDdePBj-ecs18,6071
+jscope/parsing/html.py,sha256=VS2BH64IIMAqSAb1sy1Smx4crYGIDyDqV0uvpEICdb0,2267
+jscope/parsing/queries.py,sha256=nopp_NaBOhiOx_PIVmNJO7xm-4i__kE0tuaqJ-2M-eA,16161
+jscope/parsing/wasm.py,sha256=xnJiwnrEIfYq0TR8qN40BlJema6LQ_fuiCMhiUQJ0rU,4766
+jscope/plugin/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/plugin/_worker.py,sha256=DVJRkP5-ED0LAN58J5zLyLVEbcffMCjd4TUBg3c7Bpc,10308
+jscope/plugin/loader.py,sha256=pOiRE0MZTQLgVzGkhj_Hvw0LsHuX9UwcfMu83dU-CHs,10272
+jscope/plugin/sandbox.py,sha256=inrgVN8nqkj86BBwvpY0PVqjo228CG7g5ffH7dnfGh8,9486
+jscope/reporting/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/reporting/formats.py,sha256=rWTJt3tglEA7pQJQYjdI67089-CFsvxUMpipbGOYvTI,12851
+jscope/reporting/human.py,sha256=ONaOpohGxLMRK6FjtSRkYNq6CIv3cHC7JIDHWwIFmPk,6445
+jscope/reporting/json_report.py,sha256=ynuFo5r-1mn8kouPpHBh_wBMq5SriyqD7gpwt2ePdyM,1560
+jscope/reporting/priority.py,sha256=G0WfFyKeoWZJPXiTRvC7q9RLqgWsBDvhgsq7PGxq4WU,5836
+jscope/runtime/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/runtime/observe.py,sha256=RKUWOK905DKhCo2iHcdRtPbojVoyFH0Sb5iPY_5S-So,21781
+jscope/runtime/prober.py,sha256=Dn7WS-2FjRLFhVW1yvodgP469nirrqFTqSjclWOKROg,13104
+jscope/runtime/scope.py,sha256=BBLQGozg_PYEAmjN6vZgiSsqVVGP6NFXQsENeprgnbc,12246
+jscope/verify/__init__.py,sha256=llVTlQz_rzq7ROsKITTFT7oDaRE-aZTH4iWQNIVRVPc,57
+jscope/verify/engine.py,sha256=wZCUEB0B79w_Z39wNLmTIIYSHt-VKVoeaIdQJoMHeTA,18680
+jscope/workspace/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jscope/workspace/assessment.py,sha256=hFri7O0Va1J0t8UoThdfucFPwPvZbCXrT2HW8EltSJQ,5989
+jscope/workspace/common.py,sha256=mTANh2yJ1l7H4gigA4FNxwLSXHlPqGQLAYNgqKNgXaY,714
+jscope/workspace/diff.py,sha256=dS9qwIk3Ey7h2AeIUsNx7iWBd-kOx8EA8anFXA2lJek,7188
+jscope/workspace/store.py,sha256=E2iyIdVEVIUcAdC6eEWpEigWwK1StU61YGmAntHMXpc,9937
+jscope-0.4.2.dist-info/licenses/LICENSE,sha256=jHQ-r_C-jMR_L-ibOhzB9LZEkE1LSNwF8YQN6JyWi0c,1069
+jscope-0.4.2.dist-info/METADATA,sha256=WiVutHRhMyPoGyKcWXA6aW5QxudXTeGkQ47BFpKXt-c,8208
+jscope-0.4.2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+jscope-0.4.2.dist-info/entry_points.txt,sha256=WZbGlWco6l1MfpykhcyXGgFgV5KqTIX6mLsnLQnW3-0,43
+jscope-0.4.2.dist-info/top_level.txt,sha256=KNyxdpv7mXEdW1_8F20DKfjY7wLnHorHTY7TMsppIyk,7
+jscope-0.4.2.dist-info/RECORD,,

jscope-0.4.2.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

jscope-0.4.2.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+jscope = jscope.cli:main

jscope-0.4.2.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Muhammed Ali
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

jscope-0.4.2.dist-info/top_level.txt

@@ -0,0 +1 @@
+jscope