GhostJS

What it is

GhostJS is a Java Burp Suite extension (Montoya API) from TrinetLayer that passively finds hardcoded secrets and hidden endpoints in JS/HTML/JSON. The summary covers detection breadth; what it can't carry is how you install/verify it, how it routes traffic internally, and how the author says findings must be interpreted.

How it works

Every HTTP response is inspected passively. The path branches on body type and size, and HTML responses trigger an active fetch of referenced scripts (replaying your live session cookies):

flowchart TD
    R[HTTP response] --> T{JS/HTML/JSON?}
    T -->|small body| I[scan inline → highlight proxy row]
    T -->|large body| B[background scan pool — browsing never blocks]
    T -->|HTML| S["extract <script src>/*.js"] --> AF[active-fetch + scan with cookies]
    I --> F[GhostJS tab + Proxy highlight]
    B --> F
    AF --> F

Each scan is exception-isolated and time-bounded, so one pathological file can't hang or crash Burp. The findings table never prints a full secret (masked, e.g. sk_l…MNOP); the detail pane shows full value, surrounding code, impact, and numbered remediation. Proxy history is coloured by worst severity: red=critical/high, orange=medium, yellow=low, gray=info.

Preconditions

• Burp Suite Community or Professional (works on the free edition).
• JDK 17+ only if building from source (Temurin works); the prebuilt jar needs no JDK.
• Authorized targets only — your own apps or in-scope pentest/bug-bounty engagements.

What to do

Prebuilt: grab ghostjs.jar from Releases, then Burp → Extensions ▸ Installed ▸ Add → Java → select the jar.

Build from source:

git clone https://github.com/trinetlayer/Ghost-Js-Burp-Extension.git
cd Ghost-Js-Burp-Extension
./build.sh          # downloads Montoya API, compiles, packages dist/ghostjs.jar

gradle jar also works. Regenerate detection patterns from export-patterns.mjs → GeneratedPatterns.java. Deep-dive in docs/TECHNICAL.md.

Verify against the bundled test target (fake, format-valid secrets):

./test-site/serve.sh          # serves http://localhost:8000

Load the jar, open Burp's browser, visit http://localhost:8000/ → ~18 findings across every severity, with js/placeholders.js samples correctly ignored (proving the false-positive filter).

Caveats

• Findings are hints, not confirmations — always verify a secret is live and in scope before reporting. Live validation lives in the web app / validator.trinetlayer.com, not the extension.
• Discovery rows (endpoints, S3 URLs, source-maps) are references extracted from JS, not probed — a 404 on a plain GET does not make them false positives.
• Secrets inside code comments are reported by design, not filtered.
• Domain-wide crawling, continuous monitoring, and PDF/JSON reports require the separate app.trinetlayer.com platform.