pentest-discover

name	pentest-discover
description	Discovery scan. JS bundles, API endpoints, GraphQL, secrets, BaaS backends.
user-invocable	true
allowed-tools	["Bash","Agent","Read"]

/pentest-discover — Discovery Scan

Analyze a target application to discover JavaScript bundles, API endpoints, GraphQL schemas, exposed secrets, source maps, and Backend-as-a-Service (BaaS) configurations.

Input

The target URL is provided via $ARGUMENTS. If no URL is provided, ask the user for one.

Steps

1. Parse the target URL from $ARGUMENTS.

2. Delegate to discovery-agent using the Agent tool. The agent must run the following commands, collecting all JSON output:

   pentest -k -j -o ./findings discover bundle <url>
   pentest -k -j -o ./findings discover api <url>
   pentest -k -j -o ./findings discover graphql <url>
   pentest -k -j -o ./findings baas <url>
   

3. Read the JSON outputs from ./findings/ to gather all results.

4. Present findings to the user covering:

   • Exposed secrets: API keys, tokens, credentials found in JS bundles or source maps
   • Source maps: Whether .map files are publicly accessible (leaking original source code)
   • API endpoints: Discovered REST and GraphQL endpoints, including undocumented ones
   • GraphQL introspection: Whether introspection is enabled, schema details
   • API documentation: Swagger/OpenAPI specs, GraphQL playgrounds left exposed
   • BaaS backends: Firebase, Supabase, AWS Amplify misconfigurations (open databases, permissive rules)

Notes

• All discover commands are passive and safe to run without explicit consent.
• Bundle analysis is especially valuable for single-page applications (React, Vue, Angular).
• Exposed BaaS credentials in JS bundles are a common critical finding.
• Use -k to skip SSL verification for targets with self-signed certs.
• Use -j for machine-readable JSON output.
• Use -o ./findings to persist results for later reporting.