anastasis

name

anastasis

description

JavaScript endpoint discovery and attack surface mapping for bug bounty. Discovers JS files from 23+ passive sources, extracts API endpoints via AST parsing, reconstructs sourcemaps, follows webpack chunks, probes API documentation (Swagger, GraphQL, WADL, WSDL), extracts parameters with types and constraints. Trigger on 'endpoint discovery', 'find endpoints', 'js crawl', 'discover APIs', 'anastasis', 'attack surface', 'recon endpoints', 'map API surface', 'find JS endpoints', 'scan domain', 'discover routes', 'js recon', 'API discovery'.

Anastasis — JS Endpoint Discovery

You are performing endpoint reconnaissance using the Anastasis engine. Discover every API endpoint, extract parameters, and produce an actionable attack surface map.

---

Engine Location

Resolve the engine path dynamically. Run this ONCE at the start of every session:

ANASTASIS_ENGINE=""; SKILL_REAL="$(realpath ~/.claude/skills/anastasis 2>/dev/null || readlink ~/.claude/skills/anastasis 2>/dev/null || echo "")"; if [ -n "$SKILL_REAL" ] && [ -f "$SKILL_REAL/../engine/dist/scan.js" ]; then ANASTASIS_ENGINE="$(cd "$SKILL_REAL/../engine" && pwd)"; fi; [ -z "$ANASTASIS_ENGINE" ] && for p in ~/anastasis-skill/engine ~/.local/share/anastasis/engine; do [ -f "$p/dist/scan.js" ] && ANASTASIS_ENGINE="$(cd "$p" 2>/dev/null && pwd)" && break; done; echo "${ANASTASIS_ENGINE:-NOT_FOUND}"

Store the resolved path as ANASTASIS_ENGINE for all subsequent commands. The run command is: node $ANASTASIS_ENGINE/dist/scan.js

If NOT_FOUND: tell the user to run the installer — cd anastasis-skill && ./install.sh

---

Setup Check

Before every scan, verify the engine is built:

[ -f "$ANASTASIS_ENGINE/dist/scan.js" ] && echo "READY" || echo "NOT_BUILT"

If NOT_BUILT:

cd "$ANASTASIS_ENGINE" && npm install && npm run build 2>&1 | tail -5

tree-sitter compile warnings are expected. Anastasis falls back to acorn/acorn-loose automatically — 100% parsing guaranteed.

---

Banner

 ╔═══════════════════════════════════════════════════╗
 ║   ANASTASIS — JS Endpoint Discovery Engine        ║
 ║   23+ Sources | AST Parsing | Sourcemap Recon     ║
 ╚═══════════════════════════════════════════════════╝

---

Scan Modes

Match user intent to flags. Default: Standard.

Mode	Trigger	Flags	Timeout
Quick	"quick", "fast"	--fast	60s
Standard	"scan domain" (default)	--params	180s
Deep	"deep", "thorough", "full"	--params --build-schemas --verbose --show-headers	360s
Browser	"browser", "SPA", "dynamic"	--params -b	360s
JS File	provides JS URL	-js <url> --params --build-schemas	120s
Local	provides local path	-fs <path> --params --build-schemas	120s
API Only	"swagger", "graphql", "api docs"	--api-only	60s
Batch	multiple domains	-f /tmp/targets.txt --params	360s

Always append: -o json --save /tmp/anastasis-output.json

For -u (domain) input: -u <domain> For batch: write domains to /tmp/anastasis-targets.txt first.

Custom flags from user override the table. Always ensure -o json --save is present.

Concurrency

Context	Flag	Notes
Default	(omit, uses 10)	Polite
"faster"	-c 20	Moderate
"max speed" / own infra	-c 50	Aggressive
"gentle" / rate-limited	-c 3	Conservative

---

Execution

Run Pattern

node $ANASTASIS_ENGINE/dist/scan.js <flags> 2>&1

Rules:

1. Always -o json --save /tmp/anastasis-output.json
2. Set Bash timeout per mode table (ms)
3. For known-large targets, use Bash run_in_background: true with timeout: 600000
4. Read results via Read tool on /tmp/anastasis-output.json — not stdout

Progressive Scanning (default for domain scans)

Step 1 — Fast probe (~15s):

node $ANASTASIS_ENGINE/dist/scan.js -u <domain> --fast -o json --save /tmp/anastasis-fast.json 2>&1

Show quick results. Then:

Step 2 — Full scan (~60-120s):

node $ANASTASIS_ENGINE/dist/scan.js -u <domain> --params -o json --save /tmp/anastasis-full.json 2>&1

Run full analysis.

Step 3 (on request only) — Deep + browser.

Skip progressive if user specifies a mode, or input is local/JS URL.

JSON Structure

With --params:

{
  "requestSpecs": [{
    "path": "/api/users",
    "method": "POST",
    "pathParams": [{"name": "id", "type": "string", "required": true, "confidence": 0.9}],
    "queryParams": [...],
    "bodyParams": [...],
    "cookieParams": [...],
    "headers": [{"name": "Authorization", "value": "Bearer", "isStatic": false}],
    "auth": {"type": "bearer", "name": "Authorization", "location": "header"},
    "confidence": 0.85
  }]
}

Without --params (quick mode): array of {path, method, source, confidence}.

---

Post-Scan Analysis

After reading JSON output, perform security analysis using reference files.

1. Attack Surface Summary

Read references/attack-surface-analysis.md.

Categorize endpoints:

• Auth — /login, /auth, /oauth, /token, /register, /password-reset
• User Data — /users, /profile, /account, /settings
• Admin/Internal — /admin, /internal, /debug, /metrics, /health
• File/Upload — /upload, /media, /files, /export, /import
• Payment — /payment, /billing, /checkout, /subscription
• API Versioned — /v1/, /v2/ (version discrepancies = weaker controls)
• GraphQL — /graphql (introspection = info disclosure)
• WebSocket — ws://, wss://
• Integrations — /webhook, /callback

Present as a table with counts per category.

2. Priority Targets

Read references/endpoint-prioritization.md.

Top 10-15 by bounty value:

1. Admin/sensitive endpoints without auth → auth bypass (CRITICAL)
2. Path params ({id}, {userId}) → IDOR (HIGH)
3. POST/PUT/PATCH with body params → input validation (HIGH)
4. File upload endpoints → unrestricted upload (HIGH)
5. Export/download endpoints → bulk data exfil (HIGH)
6. GraphQL mutations → privilege escalation (HIGH)
7. Deprecated API versions → bypasses (MEDIUM)
8. Low-confidence endpoints → hidden paths (MEDIUM)

3. Auth Analysis

Read references/auth-pattern-analysis.md.

• Auth types detected (Bearer, API key, Cookie, OAuth2)
• Endpoints with vs without auth
• Inconsistencies in same API group (mixed auth = bypass candidate)
• Missing auth on sensitive endpoints

4. Parameter Analysis

Read references/parameter-fuzzing-guide.md.

• email params → enumeration
• url params → SSRF
• boolean params (isAdmin, verified) → privilege escalation
• ID params → IDOR
• Rich body params → mass assignment
• Constraint boundaries → validation bypass

5. Standalone Findings

Flag without further testing:

• Sourcemap exposure → Information Disclosure
• Swagger/GraphQL introspection exposed → Information Disclosure
• Internal/staging URLs in production JS → Information Disclosure
• Build manifests exposed → Information Disclosure

6. Next Steps

Suggest concrete actions and skill chains (only if installed):

• js-analyzer → DOM XSS, postMessage, prototype pollution on discovered JS
• caido-mode → replay high-priority endpoints
• cod-review → audit recovered sourcemap sources

---

Output Format

Summary Table (always show)

Target:       example.com
Mode:         Standard (--params)
JS Files:     N discovered, M parsed
Endpoints:    X unique
With Params:  Y endpoints
Sources:      ast(N) swagger(N) graphql(N) sourcemap(N)

Endpoint Listing

Per category:

[METHOD] /path/to/endpoint
  Params: body:[field1, field2] query:[q] path:[id]
  Auth:   Bearer JWT
  Confidence: 0.92

For >50 endpoints: show top 15 by priority, summarize rest by category count.

Raw JSON on request: read and display /tmp/anastasis-output.json.

---

Error Handling

Error	Action
ENOTFOUND / DNS	Domain doesn't resolve — check spelling
ETIMEDOUT / ECONNREFUSED	Target down or blocking — try -c 3
Bash timeout	Suggest --fast or --no-api
tree-sitter warnings	Expected — acorn fallback handles it
Zero endpoints	Suggest --browser, --api-only, or check domain
Large output (500+)	Read in chunks, focus on high-priority categories

For background scans: read saved JSON on completion, run full analysis.