firstName

lastName

email

message

Let’s talk... 💬

Shriyans Sudhi

A powerful tool for JavaScript reconnaissance - discover, download, and analyze JS to uncover endpoints, secrets, and reconstruct HTTP requests to OpenAPI.


JS Recon is a tool for JavaScript reconnaissance. It helps discover, download, and analyze JavaScript files from web apps to uncover endpoints, secrets, and other valuable findings. It can also reconstruct HTTP requests an app makes and export them to OpenAPI.

I started this project in June 2025 during my internship at [Black Hills Information Security](https://blackhillsinfosec.com).

- Repository: [github.com/shriyanss/js-recon](https://github.com/shriyanss/js-recon)
- Docs Site: https://js-recon.io

## Key features

- Download dynamically loaded JS (lazy-loaded bundles) from supported frameworks
- Extract URLs, strings, endpoints, and potential secrets from JS files
- Reconstruct HTTP requests and export to OpenAPI
- Analyze JS code and HTTP request behavior for potential issues
- Orchestrate end-to-end assessments with the `run` module
- Optional AWS API Gateway IP rotation to reduce rate-limit issues
- Generate consolidated reports from analysis results

## More info

Please visit the [JS Recon site](https://js-recon.io) for more information.


A powerful tool for JavaScript reconnaissance - discover, download, and analyze JS to uncover endpoints, secrets, and reconstruct HTTP requests to OpenAPI.

JS Recon

subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery

subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery. It is a Python based tool, which takes the user inputs, and is capable of generating several 100 GBs of permutations. Please note that this tool is expected to run several hours and is expected to run on a VPS.

This project has its code hosted on [GitHub/@shriyanss/subdomain-permut](https://github.com/shriyanss/subdomain-permut). Additionally, it is also available on [PyPI/subdomain-permut](https://pypi.org/project/subdomain-permut/). To install this tool, you can use the following command

```
pip install subdomain-permut
```

To upgrade the tool in case a new version is available, use the following command

```
pip install --upgrade subdomain-permut
```


subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery.

Subdomain Permut - Subdomain Permutation tool

Subdomains wordlist generator helps you generate wordlists from the subdomains found from the subdomain enumeration. It uses a combination of Python and Shell scripts to achieve the task.

You can check this project at [GitHub/@shriyanss/subdomain_wordlist_gen](https://github.com/shriyanss/subdomain_wordlist_gen)


Generate custom subdomain wordlists from enumeration results using Python and Shell scripts.

Subdomains Wordlist Generator

"Subdomains Wordlist" is a repository containing a list of subdomain wordlists that can be used to bruteforce assets for a company. A full blog on how this is generated can be found at [My Website/Blog/SUBDOMAINS WORDLIST. HOW IT IS MADE?](https://ss0x00.com/blog/subdomains-wordlist-how-it-is-made/)

The repository can be found at [GitHub/@shriyanss/subdomains_wordlist](https://github.com/shriyanss/subdomains_wordlist)


A comprehensive wordlist of commonly found subdomains for asset discovery and brute-forcing.

Subdomains wordlist

VHost Master is a virtual host fuzzer. It is written in Python and utilizes multiple threads to speed up the process. You can find it on GitHub at [GithHub/@shriyanss/vhost-master](http://github.com/shriyanss/vhost-master)


Virtual Host Fuzzer written in Python. A multi-threaded tool to speed up virtual host discovery.

VHost Master

Javascript payload for exploiting blind XSS. You can simply host `payload.js` file editing the specifications for an ultimate XSS

You can find the repository at [GitHub/@shriyanss/payload-pro](https://github.com/shriyanss/payload-pro)


JavaScript payload configuration for exploiting and managing blind XSS attacks.

Payload Pro

Log Venom is a shell script to send some payloads in the target server's log. This includes XSS payloads. The repository can be found at [GitHub/@shriyanss/Log-Venom](https://github.com/shriyanss/Log-Venom)


Log Venom is a shell script to send payloads like XSS to a target server's log.

Log Venom

Explore open-source security tools and projects developed by Shriyanss for penetration testing and bug bounty hunting.

Projects