Jsmon just hit a new record 📈
This month alone: 444,509 URLs scanned
Last 3 months combined: 373,746
One month > three months.
We launched Recurring Scans recently — set it once, monitor continuously. Looks like the numbers agree it was the right call.
Coming up on 500K scanned this month. Watch this space.
→ https://t.co/KAxMTnrEmT
No need to reverse engineer big minified JS files, chunks, sourcemaps yourself now.
Find GraphQL Queries, Mutations and Fragments from Javascript files in Jsmon Scans for free.
> Scan a host at Jsmon (which contains graphql)
> Go to Reconnaissance, click on GraphQL [Operation]
Cloudflare won't save you.
Jsmon now bypasses WAFs to scan what's actually exposed behind your firewall: Cloudflare, Akamai, and more.
Watch the 30-sec demo over Cloudflare-protected domain 👇 Live at https://t.co/10muV7baIG
Just shipped the biggest Jsmon update since we launched.
85% price drop + completely new UI + way better search/filters.
$15/mo gets you hacker-grade security scans.
This started as bash scripts for bug bounty hunting. Now it's accessible to every security researcher.
https://t.co/OezEeQKWSR
This is damn fast for the larger files 🔥. Even I am using it for my automation. Like I have tried it on 20 M subdomains to test on 8 GB/4 core conf Server. And it is like 5-6 times faster than anew.
We just open-sourced xnew — a blazing fast CLI for appending unique lines to files 🚀
Built in Go for security researchers working with massive datasets. Streams efficiently with minimal memory footprint.
📊 Benchmarks (vs anew):
- 100M lines: 30s vs 1m38s
- 10M lines: 2.8s vs 12.4s
- Scales cleanly from 1K to 100M+ lines
Perfect for:
→ Subdomain deduplication
→ Endpoint lists
→ Wordlist management
→ Any large-scale data pipeline
⭐ https://t.co/8vWVWA7aiz
Uses XXH3 hashing + buffered I/O. Minimal memory, maximum speed.
#infosec #bugbounty #golang #opensource
- Shoutout to @jsmonsh for S3 takeover discovery
- Reported, triager marked Informative
- App fetching from same S3 bucket
- Took over, uploaded image on path
- App fetching my image now
- Commented impact, changed to Triaged
- Reported to @intigriti
No jailbreak. No problem. 🔓
I built a tool that bypasses iOS SSL Pinning using OpenVPN + iptables — works with Burp Suite & mitmproxy out of the box.
👇 GitHub
https://t.co/N4QyCDaXvR
#CyberSecurity#BugBounty#iOS#Pentesting
There are dozens of JS analysis tools available for bug hunters.
Each one has its own unique strengths.
Here are 4 tools I personally use to streamline my workflow: 🧵
Here's how you can do better API-contextful fuzzing by using JS files:
1. Scan domain/URL at https://t.co/wZXxcFV7OV
2. Go to JS Intelligence > API Paths
3. Export all the API endpoints
Make a wordlist and use ffuf or kiterunner to fuzz on dev/prod/staging APIs.
#bugbountytips
We’re hosting a live webinar on ‘Listening like a Hacker with Jsmon’. Join us with the below link
Webinar link : https://t.co/6SxZUlzLA1
#cybersecurity#hackers
If you found a package.json file in the wild, you might find some internal packages vulnerable to a dependency confusion attack 👀
Check for it quicker using this cool new tool by JSMon: https://t.co/zjdmSzRfqy 👇
From your feedback, to our team’s hard work → Jsmon 2.0 is here.
✨ Cleaner design
📊 Easier reporting
⚡ More power under the hood
Thank you for helping us build the future of JavaScript security 💜
Check it out → https://t.co/J9zl7BBy2G