| name | js-reverse |
| description | Front-end JavaScript reverse engineering for web apps and anti-bot engines: observe request flows, capture logic via hooks or breakpoints, rebuild in a local Node environment, apply minimal patches, and decode obfuscated signing algorithms. Use when analyzing request signing chains, obfuscated SDKs, or client-side protection logic. |
| domain | cybersecurity |
| subdomain | web-application-security |
| tags | ["javascript","reverse-engineering","deobfuscation","anti-bot","web-application-security","devtools","signing-algorithm"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["DE.AE-02","RS.AN-03","ID.RA-01"] |
Front-End JavaScript Reverse Engineering
Overview
Modern web applications move security logic (request signing, anti-bot
tokens, risk scoring) into the browser. Reversing that logic is a discipline
with its own order of operations: observing traffic first, capturing the
relevant code path, rebuilding the logic in a controlled local environment,
and only then patching or decoding. Jumping straight to breakpoints or
deobfuscation is how reversers burn hours on the wrong code.
This skill provides a five-phase workflow — Observe → Capture → Rebuild →
Patch → Decode — plus the execution discipline (evidence-first, artifact
per task, minimal patches) that keeps the process reproducible. It is
tool-agnostic: the same workflow runs on Chrome DevTools, Playwright,
puppeteer, or any CDP-capable driver, and on any runtime rebuilt in Node.js.
Source: cherry-picked and translated from zhaoxuya520/reverse-skill
(skills/js-reverse, MIT license). MCP-specific tool bindings were
generalized to standard browser/CDP tooling.
When to Use
Trigger phrases:
- "reverse the signing logic of this request"
- "how is this frontend token generated"
- "analyze obfuscated JS behavior"
- "rebuild a client-side algorithm in Node"
- "patch a JS function to verify a hypothesis"
- "deobfuscate control flow of a web SDK"
Use this skill when:
- A request carries a signature, token, or header you must reproduce or
understand (for security review, testing, or interoperability).
- Obfuscated or minified client code hides the algorithm.
- You need to confirm behavior before writing a rewrite (verify the real
runtime, never assume from source shape).
Prerequisites
- Chrome (or Chromium) with DevTools; Playwright/puppeteer if scripting.
- Node.js 18+ for local rebuilds.
- A beautifier (prettier or js-beautify) and a proficient code editor.
Workflow
Phase 1: Observe
- Open DevTools → Network, filter by the target request type; identify the
target request URL.
- Open the initiator chain / call stack of that request to find the entry
function.
- Locate the script that issues the request: find the JS file URL, then the
function name and approximate line in the Sources panel.
- Take notes on the request header names you must reproduce and their current
values.
Phase 2: Capture
- Break-on-XHR first: enable XHR breakpoints on the target URL so the
stack lands at the exact call site — the most direct capture point.
