Hacking ENDPOINT PASSIVE RECON

[dEEpEst]

↳ ENDPOINT PASSIVE RECON

• Extract URL Paths or Routes via Dev Tools
Use the following JavaScript snippet in the browser console to passively enumerate all unique paths from <a href> elements:

[...new Set([...document.querySelectorAll("a[href]")].map(a => new URL(a.href, location.href).pathname))].forEach(path => console.log(path));

• Save and Download a .txt File with All Those Paths:
This snippet will automatically extract the paths and trigger a download of a `.txt` file named after the domain:

(() => {
    const paths = [...new Set([...document.querySelectorAll("a[href]")].map(a => new URL(a.href, location.href).pathname))];
    const blob = new Blob([paths.join("\n")], { type: "text/plain" });
    const a = document.createElement("a");
    a.href = URL.createObjectURL(blob);
    const domain = location.hostname.replace(/^www\./, "");
    a.download = `${domain}.txt`;
    document.body.appendChild(a);
    a.click();
    document.body.removeChild(a);
})();

This method is fully passive—no external requests are made, making it ideal for stealth recon during web assessments.

Join the discussion:
What other passive techniques do you use for recon? Have you integrated this approach with automation tools like Puppeteer or Playwright? Drop your methods, enhancements, or tools below!

---

Created for the Hack Tools Dark Community. For educational and red teaming purposes only.