<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-javascript-detection-templates
description: >-
  Build Nuclei templates for detecting JavaScript-based vulnerabilities
  and exposed client-side secrets. Covers JS library fingerprinting,
  source map exposure, API key leakage, DOM-based XSS sinks, and
  client-side dependency analysis in web applications.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - javascript
  - detection
  - secrets
  - client-side
  - templates
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.007"]
---

# Building JavaScript Detection Templates

## Overview

JavaScript detection templates identify security issues in client-side code
including exposed API keys, vulnerable library versions, source map files,
debug endpoints, and sensitive configuration objects. These templates analyze
JS file contents, inline scripts, and bundled application code accessible
via HTTP to surface secrets and weaknesses.

Mode: `[MODE: RED]` — Client-side secret and vulnerability detection.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ (`nuclei -version`) | Required |
| Understanding of JavaScript bundlers (webpack, vite, rollup) | Required |
| Familiarity with common JS libraries and their known vulnerabilities | Required |

## Key Concepts

### Exposed Source Maps

```yaml
id: javascript-source-map-exposure

info:
  name: JavaScript Source Map File Exposure
  author: nerf
  severity: medium
  description: |
    Detects exposed JavaScript source map files that reveal original
    source code, internal file paths, and application architecture.
    Source maps are generated by bundlers and should not be deployed
    to production servers.
  classification:
    cwe-id: CWE-540
  tags: js,sourcemap,exposure,misconfig
  metadata:
    max-request: 4

http:
  - method: GET
    path:
      - "{{BaseURL}}/main.js.map"
      - "{{BaseURL}}/app.js.map"
      - "{{BaseURL}}/bundle.js.map"
      - "{{BaseURL}}/static/js/main.js.map"
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"sources"'
          - '"mappings"'
        condition: and
      - type: status
        status:
          - 200
      - type: word
        part: header
        words:
          - "application/json"
          - "application/octet-stream"
        condition: or
    extractors:
      - type: json
        part: body
        json:
          - '.sources[:5]'
```

### API Key Leakage in JavaScript

```yaml
id: javascript-api-key-leakage

info:
  name: API Key Leakage in JavaScript Files
  author: nerf
  severity: high
  description: |
    Detects hardcoded API keys, secret tokens, and credentials embedded
    in JavaScript bundles. These secrets are accessible to any user who
    views the page source or inspects network traffic.
  classification:
    cwe-id: CWE-798
  tags: js,api-key,secrets,exposure
  metadata:
    max-request: 3

http:
  - method: GET
    path:
      - "{{BaseURL}}/main.js"
      - "{{BaseURL}}/app.js"
      - "{{BaseURL}}/static/js/bundle.js"
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'AKIA[0-9A-Z]{16}'
          - 'sk-[a-zA-Z0-9]{20,}'
          - 'ghp_[a-zA-Z0-9]{36}'
          - 'xox[boaprs]-[a-zA-Z0-9-]+'
        condition: or
      - type: status
        status:
          - 200
    extractors:
      - type: regex
        part: body
        regex:
          - '(AKIA[0-9A-Z]{16})'
          - '(sk-[a-zA-Z0-9]{20,50})'
          - '(ghp_[a-zA-Z0-9]{36})'
        group: 1
```

### Vulnerable JavaScript Library Detection

```yaml
id: vulnerable-jquery-detection

info:
  name: Vulnerable jQuery Version Detection
  author: nerf
  severity: medium
  description: |
    Detects outdated jQuery versions with known XSS vulnerabilities.
    jQuery versions prior to 3.5.0 are vulnerable to prototype
    pollution and cross-site scripting attacks.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11023
  classification:
    cve-id: CVE-2020-11023
    cwe-id: CWE-79
  tags: js,jquery,xss,outdated,cve
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'jquery[.-]([12]\.[0-9]+\.[0-9]+|3\.[0-4]\.[0-9]+)'
      - type: status
        status:
          - 200
    extractors:
      - type: regex
        part: body
        regex:
          - 'jQuery\s+v?([0-9]+\.[0-9]+\.[0-9]+)'
          - 'jquery[.-]([0-9]+\.[0-9]+\.[0-9]+)'
        group: 1
```

### Webpack Development Artifacts

```yaml
id: webpack-dev-artifacts

info:
  name: Webpack Development Artifacts Exposure
  author: nerf
  severity: medium
  description: |
    Detects webpack development artifacts including stats files,
    hot module replacement endpoints, and bundle analyzer reports
    left accessible on production servers.
  classification:
    cwe-id: CWE-540
  tags: js,webpack,dev,exposure,misconfig
  metadata:
    max-request: 4

http:
  - method: GET
    path:
      - "{{BaseURL}}/webpack.config.js"
      - "{{BaseURL}}/stats.json"
      - "{{BaseURL}}/report.html"
      - "{{BaseURL}}/__webpack_hmr"
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "module.exports"
          - '"chunks"'
          - "webpack-bundle-analyzer"
          - "hot-update"
        condition: or
      - type: status
        status:
          - 200
```

## Workflow

### Step 1: Validate Template

```bash
nuclei -t js-detection.yaml -validate
```

### Step 2: Scan Target

```bash
node scripts/agent.js --action scan --target https://app.example.com \
  --template js-detection.yaml --output /tmp/js-scan.json
```

### Step 3: Extract Discovered Secrets

```bash
node scripts/agent.js --action scan --target https://app.example.com \
  --template api-key-leakage.yaml --output /tmp/secrets.json
```

## Verification

- [ ] Regex patterns for API keys match real key formats
- [ ] Source map detection confirms JSON structure, not just 200 status
- [ ] Library version extractors capture semver strings
- [ ] Templates check common JS bundle paths and naming conventions
- [ ] No false positives from minified variable names
- [ ] `stop-at-first-match` used for multi-path discovery templates
- [ ] `max-request` metadata matches actual request count

## References

- [Nuclei HTTP Protocol](https://docs.projectdiscovery.io/templates/protocols/http/basic-http)
- [OWASP Client-Side Testing](https://owasp.org/www-project-web-security-testing-guide/)
- [Retire.js Vulnerability DB](https://retirejs.github.io/retire.js/)
- [Trufflehog Secret Patterns](https://github.com/trufflesecurity/trufflehog)
