From 4ff6f7be6c15bf3eff066ab628e1008826cf8966 Mon Sep 17 00:00:00 2001
From: rpriven <rob.pratt@tutanota.com>
Date: Fri, 17 Jul 2026 19:53:11 -0600
Subject: [PATCH] web.cheat: add hidden-API recon (follow JS to internal API,
 replay call)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Content behind a JS shell — crawl JS with katana or capture with
mitmproxy/Burp, then replay the internal call with session cookie + CSRF header.

Co-Authored-By: Kai <kai@djeditech.com>
---
 web.cheat | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/web.cheat b/web.cheat
index 74a892c..0748eb9 100644
--- a/web.cheat
+++ b/web.cheat
@@ -51,9 +51,26 @@ curl http://<target> -b "session=<cookie>"
 # Curl with headers
 curl http://<target> -H "Authorization: Bearer <token>"
 
+# --- Hidden API recon: content behind a JS shell ---
+# Page renders blank to curl/wget? The content loads from an internal API the
+# page's JavaScript calls after render. Find that call and replay it yourself.
+
+# Crawl the site's JS for endpoints (ProjectDiscovery katana)
+katana -u https://<target> -jc -silent | grep -iE 'api|graphql|\.json'
+
+# Or watch the exact call live, then copy it as curl (mitmproxy / Burp intercept)
+mitmproxy
+
+# Replay the internal call with your session cookie + any CSRF header
+# (CSRF header value often must match the session cookie, e.g. JSESSIONID)
+curl -s -b <cookiejar> -H "csrf-token: <token>" -H "user-agent: <ua>" "<api_url>"
+
 $ target: echo ""
 $ domain: echo ""
 $ wordlist: echo "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
 $ database: echo ""
 $ cookie: echo ""
 $ token: echo ""
+$ cookiejar: echo "cookies.txt"
+$ ua: echo "Mozilla/5.0"
+$ api_url: echo ""