aurovvqy

Extracting Hidden API Endpoints from React SPA Bundles: A Repeatable Recon Workflow

How to reconstruct an entire API surface from client-side code when directory scanning returns nothing but 200s.

---

Most bug bounty targets today ship as single-page applications (SPAs). The server hands you a near-empty index.html, and a few megabytes of JavaScript draw the entire app. Buried inside those bundles is the application's real attack surface — every API operation the frontend can call, along with the exact wire format it uses to call them.

This article walks through a repeatable workflow for extracting that surface, using a real (anonymized) engagement as the example.

peakpot1

/*
脚本引用 https://raw.githubusercontent.com/Keywos/rule/main/script/wy/js/wyres.js
*/
// @timestamp thenkey 2025-02-19 07:37:36
(()=>{
  var x=typeof globalThis<"u"?globalThis: {

  },
  J={
    exports: {

rh-operator-bundle-bot

{
  "passed": true,
  "results": {
    "errors": [],
    "failed": [],
    "passed": [
      {
        "description": "Check to make sure that all CRs have a spec block.",
        "elapsed_time": 3215.0,
        "name": "ScorecardBasicSpecCheck"

ajeshbs

# ============================================================
# RDP-Only Firewall Toggle (Lock / Unlock) - INTERACTIVE
# Run in an elevated PowerShell (Run as Administrator)
#
# Usage (local file):
#   .\rdp-firewall-toggle.ps1
#
# Usage (from Gist, once you've uploaded this file):
#   irm https://gist.githubusercontent.com/<you>/<gist-id>/raw/rdp-firewall-toggle.ps1 | iex
#   (see NOTE at bottom of this file before using irm | iex)

HugsLibRecordKeeper

Log uploaded on Thursday, August 13, 2026, 1:58:40 AM
Loaded mods:
Harmony(brrainz.harmony)[mv:2.4.2.0]: 0Harmony(2.4.1), HarmonyMod(2.4.2)
Core(Ludeon.RimWorld): (no assemblies)
Royalty(Ludeon.RimWorld.Royalty): (no assemblies)
Ideology(Ludeon.RimWorld.Ideology): (no assemblies)
Biotech(Ludeon.RimWorld.Biotech): (no assemblies)
Anomaly(Ludeon.RimWorld.Anomaly): (no assemblies)
Odyssey(Ludeon.RimWorld.Odyssey): (no assemblies)
HugsLib(UnlimitedHugs.HugsLib)[ov:12.0.0]: 0Harmony(av:2.4.1,fv:1.2.0.1), HugsLib(av:1.0.0,fv:12.0.0)

neobuilds

120	kener	09466220f91b61169e612dee0e3c7ca825cdcc30	1	1

motyzk

l = [0, 1, 2, 3]

for n in l:
    n = 10

print(l)

for i in range(len(l)):
    l[i] = 10

AlexOn1ine

void TryStatChange(struct BattleCalcValues *cv, struct StatChange *st)
{
    u32 numChanges = 0;
    s8 statsChanged[NUM_BATTLE_STATS + 1];
    s32 minMaxStage = 0;

    enum StatChangeProcess process = PROCESS_STAT_DEFAULT;

    for (u32 i = 0; i < NUM_BATTLE_STATS + 1; i++)
        statsChanged[i] = END_NUM_CHANGES;

michaelaflores

# Agent-friendly architecture

Dune assumes many contributors arrive with a narrow prompt, a few nearby files, and no complete model of Sand. the locally obvious change the globally correct change. Unsafe shortcuts fail with an error that names the supporte
This page defines the contributor context model and the architecture choices that keep repeated local edits from 

## Contract

A coding agent usually optimizes for what fits in its context:
- copy the nearest working pattern;
- edit the file already open;

HugsLibRecordKeeper

Log uploaded on Thursday, August 13, 2026, 1:55:18 AM
Loaded mods:
Harmony(brrainz.harmony)[mv:2.4.2.0]: 0Harmony(2.4.1), HarmonyMod(2.4.2)
FSharp.Core(latta.fsharp.core): FSharp.Core(av:4.7.0,fv:4.700.20.27008), Poet(5.4.1)
Core(Ludeon.RimWorld): (no assemblies)
Royalty(Ludeon.RimWorld.Royalty): (no assemblies)
Ideology(Ludeon.RimWorld.Ideology): (no assemblies)
Biotech(Ludeon.RimWorld.Biotech): (no assemblies)
Anomaly(Ludeon.RimWorld.Anomaly): (no assemblies)
Odyssey(Ludeon.RimWorld.Odyssey): (no assemblies)