Take the 2-minute tour ×

I'd like to determine if a given JavaScript contains the logic to make a AJAX/WCF call, or determine if one is being executed at runtime.

Does anything like this exist?

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

Im using Firefox plugin called JavaScript Deobfuscator. This works very well as Im able to see all scripts that are compiled and all executed scripts. This updates on the fly, and contains good details on all the executed scripts.

You can also use filters to only capture javascript on a given domain. This plugin has helped me a lot in web pentesting.

You can find it here https://addons.mozilla.org/en-US/firefox/addon/10345/

Quote from the plugin page:

This add-on will show you what JavaScript gets to run on a web page, even if it 
Tools menu and watch the scripts being compiled/executed.
share|improve this answer
add comment

If you want to examine the javascript, ala code review, @joni's answer is best - search for XMLHttpRequest, but also eval, relevant JQuery methods, and might as well include image tags, script tags, XML tags, and any other tag that can retrieve a remote URI - CSS included.

However, if you have the option it would be much simpler to determine at runtime - simply attach a sniffer or proxy, and watch what happens.
Of course, you'd still have to make sure to trigger whatever conditions set it off, but still much simpler.

share|improve this answer
add comment

Simple would be to just grep for XMLHttpRequest. But this is far from complete, because there are plenty of other ways to set up a HTTP request (e.g. by adding an image or script tag to the DOM). Additionally, a malicious user could use eval() in combination with rot13 or whatever else obfuscation function, and I bet there are thousands of other cheap tricks. The answer is, you'd have to implement a complete Javascript engine which executes the code in a sandbox and then traces any request.

share|improve this answer
add comment

Your Answer


