Browser extension for finding hidden web endpoints and sensitive strings
LoveJS, by n0name, is a Firefox browser extension built for vulnerability mining and in-browser reconnaissance. It analyzes page content and JavaScript source to surface undocumented API endpoints and embedded strings during live inspection. The extension bundles batch URL opening and a local-storage notepad to support multi-target testing and note keeping. Targeted at web developers, security researchers, and penetration testers, it centralizes information gathering inside the browser so auditors can verify findings without switching tools.
What sensitive data does the extension extract during audits?
LoveJS scans both page markup and loaded JavaScript to flag concrete artifacts. The tool looks for contact details and credential-like strings, including email addresses, phone numbers, and cloud service keys (examples noted include AWS and Google Cloud style keys). It also identifies hidden API endpoints and interfaces buried in scripts, producing a concise list auditors can review for follow-up verification.
How does LoveJS fit into browser-based testing workflows?
The extension provides mechanisms to refine and verify discovered endpoints within the browser environment. Users can apply custom base-directory filters and domain blacklists to focus results, and the URL concatenation feature joins discovered interfaces with domains for quick checks. Compatibility is centered on Firefox, and the extension can be installed on Chromium-based browsers through manual installation. The project publishes its source on GitHub, enabling code inspection and auditability.
Who benefits from using this tool and what expertise does it assume?
LoveJS targets practitioners who already work with JavaScript and HTTP interfaces. Web developers performing security reviews, security researchers, and penetration testers gain most from in-browser discovery and batch verification. The built-in notepad stores notes locally, which suits testers who keep session artifacts in the browser. Users should expect a technical workflow that assumes familiarity with source inspection and endpoint validation.
Practical choice for technical auditors who accept a browser-centered workflow
LoveJS is a practical option for penetration testers and developers who need in-browser discovery and reproducible findings, because it focuses on extracting interface artifacts and credential-like strings from page and script sources. It assumes users are comfortable inspecting JavaScript and managing browser-based verification steps; teams that require out-of-browser automation or non-technical onboarding should evaluate whether a browser extension fits their process.
