jsleak: uncover secrets and links in JavaScript files or source code

by ddos · March 11, 2026

jsleak

It is an easy-to-use command-line tool designed to uncover secrets and links in JavaScript files or source code. The jsleak was inspired by Linkfinder and regexes are collected from multiple sources.

Features:

Discover secrets in JS files such as API keys, tokens, and passwords.
Identify links in the source code.
Complete Url Function
Concurrent processing for scanning of multiple Urls
Check the status code if the url is alive or not

To Do

Scan secret on completeURL with 200 response.
Add Version flag.
Support scanning local files.
Support scanning apk files.
Update Regex.
Support mulitple user agents.

Install

If you are using old version of golang (go 1.15, 1.16) , use the following command to install jsleak.

go get github.com/channyein1337/jsleak

If you are using latest version of go (1.17+) , use the following command to install.

go install github.com/channyein1337/jsleak@latest

Use

Secret Finder

echo http://testphp.vulnweb.com/ | jsleak -s

Link Finder

echo http://testphp.vulnweb.com/ | jsleak -l

Complete Url

echo http://testphp.vulnweb.com/ | jsleak -e

Check Status

echo http://testphp.vulnweb.com/ | jsleak -c 20 -k

You can also use multiple flags

echo http://testphp.vulnweb.com/ | jsleak -c 20 -l -s

Running with Urls

cat urls.txt | jsleak -l -s -c 30

Source: https://github.com/channyein1337/

Support Our Threat Intelligence

If you find our technology report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal