All Your Frontend Are Belong To Us - Crawling Through Javascript Using ASTs

The talk looks at reconnaissance of web applications by pulling apart their frontend JavaScript. The speaker compares this to scouting in strategy games: map what is exposed, find hidden endpoints, and predict how the target is built before acting. Frontend bundles mix application code, library code and sometimes abandoned endpoints, and minification makes them hard to read with text matching.

The core idea is to parse the code into an abstract syntax tree rather than search for strings. Borrowing a habit from debugging, the approach starts at a fetch call and walks backwards to see where each argument comes from. It follows imports across files and renamed exports, then lists every way an endpoint is called. Because the tree stays the same when code is minified or its names change, the analysis holds up on production bundles. Browser native APIs are emulated, and common libraries are treated as wrappers around fetch or XMLHttpRequest.

The prototype, named Lurker, is still private and was shown on simple test code with some real results. Dynamic values remain the main burden, along with other pitfalls the speaker is still working through. The talk closes by asking for real applications to test against. The practical takeaway is that syntax-tree analysis can recover API surface from modern JavaScript more reliably than text search.