AKHA SourceMap Scanner

Fast source map exposure scanner for JavaScript assets

Features • Quick Start • Usage • Disclaimer

---

Features

• Auto discovers and downloads .js.map files from JS URLs
• Extracts source files and tries to recover missing sourcesContent
• Scans code with a large security pattern set (keys, tokens, endpoints, PII)
• Optional passive endpoint verification with risk labels
• Generates terminal output, text report, and HTML report

Install

git clone https://github.com/akha-security/akha-sourcemap.git
cd akha-sourcemap
pip install requests urllib3

Usage

# Single target
python sourcemap_scanner.py -u https://example.com/app.js

# URL list mode
python sourcemap_scanner.py -f urls.txt

# Save text report (Even if you use the -o parameter, it will generate an HTML report.)
python sourcemap_scanner.py -u https://example.com/app.js -o report.txt

# Passive verification mode
python sourcemap_scanner.py -u https://example.com/app.js --verify-passive

Main Options

-u, --url                 Single JS/JS.map URL to scan
-f, --file                File with target URLs
-o, --output              Text report file path
-t, --threads             Concurrent workers (default: 5)
--sources-dir             Source output directory (default: ./output)
--verify-passive          Enable passive endpoint verification
--verify-timeout          Verify timeout in seconds (default: 8)
--verify-max-targets      Max verification targets (default: 40)

Scanner Screenshot

Report Screenshot

Output

• Extracted source files in the selected output directory
• Text report if -o is provided
• HTML report generated automatically

⚠️ Disclaimer & Ethical Use

AKHA-SOURCEMAP is developed for educational and authorized professional security testing purposes only.

• Do NOT employ this tool against systems, networks, or applications that you do not hold explicit, documented permission to test.
• Use staging environments whenever possible. The developers assume zero liability and are not responsible for any misuse, damage, or legal consequences caused by the operation of this software. You act entirely at your own risk.