domains / families / security / hunt-spa-api

hunt-spa-api

authentic

Discover a single-page-app's hidden backend API from its public JS bundle,

When to use

• A target host returns a tiny HTML shell + big `/static/js/*.js` or `/_next/static/*` bundles (React/Vue/Angular/Next/Svelte SPA)
• You see a subdomain named `console`, `app`, `dashboard`, `portal`, `admin`, `panel`, `manage`, `internal`
• Recon surfaces any `*api*`, `*-api*`, `api.*` host
• A login page is OAuth/SSO-gated (the *frontend* auth tells you nothing about whether the *API* enforces auth)

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Source