Skip to content

README.md

Latest commit

 

History

History
160 lines (119 loc) · 7.1 KB

README.md

File metadata and controls

160 lines (119 loc) · 7.1 KB
Raw

ExecEndpoints

Deep endpoint & request extraction inside your own authenticated session.
Capture every API request a site makes — real method, params, and per-host JWT/cookies — then mine its JavaScript for hidden endpoints. 100% local.

Chrome Manifest V3 Python stdlib only No dependencies Runs locally License MIT

ExecEndpoints is a two-part recon toolkit for authorized web security testing and bug-bounty work:

  • a Chrome extension that watches the real requests a web app makes (via the DevTools Protocol), and
  • a tiny local Python server that mines the app's JavaScript and hosts a rich dashboard.

Dynamic capture (extension) + deep static extraction (server) = full endpoint coverage. The extension sees the real, dynamically-built API calls that static analysis can't; the server digs out endpoints from JavaScript that never even executed.

Contents

✨ Features

  • One-click capture. Hit Send — the extension reloads the target and watches every request until the network goes idle, recording the real HTTP method, query & body parameters, and the correct per-host JWT/cookies. Nothing loaded late is missed.
  • JavaScript endpoint mining. Live JS/JSON responses and a deep static pass on the server: template-literal API paths (`${base}/api/…`), call-site method/params (fetch/axios/$.ajax/XHR), webpack/Vite/Next chunk-following, and cross-domain API reassembly.
  • Same-domain scope, done right. Keeps the target's registrable-domain family (so api.example.com counts for app.example.com); drops third-party trackers/analytics/CDNs — and never denies the target's own domain.
  • Per-host auth. Every API host (api., gateways, the app host) carries its own captured Cookie/JWT when you replay a request.
  • Typed secret scanner. 120+ detectors (AWS, GCP, Stripe, Slack, JWT, …) with false-positive filtering and ready-to-submit reports (RAW-HTTP PoC, one vuln per report).
  • Rich dashboard. Endpoints, Parameters, GraphQL ops, Keys, Subdomains, Libraries, an API Graph, and a Repeater — all using your captured session. Pretty-printed JSON, cURL/RAW-HTTP export, per-host auth chips.
  • Safe by design. Passive by default (never probes on its own), binds to 127.0.0.1, no dependencies, no telemetry.

🖼 Preview

ExecEndpoints dashboard

🏗 How it works

Architecture

The Send capture flow

🚀 Quick start

1 · Start the local server

cd server
python execendpoints.py serve

On Windows, just double-click server/ExecEndpoints.bat. It runs on http://127.0.0.1:8791 (Python 3.8+, no pip install).

2 · Load the extension

  1. Open chrome://extensions
  2. Enable Developer mode (top-right)
  3. Load unpacked → select the extension/ folder
  4. Pin ExecEndpoints from the puzzle-piece menu

A step-by-step tutorial opens automatically the first time you install the extension. Reopen it anytime from the popup (📘 Show tutorial) or the dashboard's ? button.

3 · Capture

  1. Open a site you're authorized to test and sign in.
  2. Click the ExecEndpoints icon → Send.
  3. It reloads the page, captures everything until the network settles, pushes it to the dashboard, and starts the deep JS scan.
  4. Open http://127.0.0.1:8791 and explore.

📊 The dashboard

Tab What you get
Endpoints method, path, status, params · interesting-first ranking · search / exclude / filter
Parameters every query & body parameter, interesting-first
GraphQL operations by query/mutation with args + ready request bodies
🔑 Keys typed secret detector + one-click RAW-HTTP report per finding
Subdomains / Libraries discovered hosts + fingerprinted libs with versions
API Graph pan/zoom SVG map of all endpoints, method-colored
Repeater edit any request and replay it with your captured session

Click any endpoint to Fetch + mine it with your session, view the JSON response pretty-printed, copy it as cURL or RAW HTTP, or open it in a new tab.

🔒 Scope & safety

  • Same-domain only — the target's registrable-domain family; third-party trackers are dropped.
  • Passive by default — the background scan never probes discovered endpoints; you actively fetch one only when you click Fetch.
  • Local-only — the server binds to 127.0.0.1; your captures never leave your machine.
  • Authorized use only — see the disclaimer.

📦 Publishing / packaging

  • Build a Chrome Web Store .zip of the extension:

    powershell -ExecutionPolicy Bypass -File package-extension.ps1

    → dist/ExecEndpoints-<version>.zip (manifest at the zip root, forward-slash paths).

  • Full submission walkthrough (permission justifications, privacy declaration): docs/PUBLISHING.md

  • User-facing tutorial (same as the in-app one): docs/TUTORIAL.md

⚠ Disclaimer

ExecEndpoints is for authorized security testing and research only. Only run it against targets you have explicit permission to test (your own apps, a bug-bounty program's in-scope assets, an engagement you're contracted for). You are solely responsible for how you use it. The authors accept no liability for misuse.

Because it uses Chrome's debugger API, Chrome shows a "…is debugging this browser" banner while capturing. ExecEndpoints detaches automatically after each Send, which clears it.

📄 License

MIT © 2026 ExecEndpoints