JS Disector

What is a webpage's Javascript actually doing? JS Disector says which functions run, variables set, and even lets you manipulate and replay functions and variables. Bend JS to your will in real time!

Comment

Inspiration

I was taking mandatory HR trainings online with unskippable videos and quiz questions - you know the ones - and as a JS developer, wanted a way to bend client code to my will. I would usually use Fiddler for this but it's hardly worth the effort. The allure was knowing I had javascript running in my browser that was just out of my fingertips: I could kind of see the source in devtools, but it's annoying to trace through and I can't edit it. So when websites disable right-click, or are coded horribly using global variable to track membership status, or even scores in HTML games, I wanted a tool where I could break that barrier and exploit the site. This tool can also help actual developers understand how people can break their website by trusting client code too much.

What it does

Monitor, inspect, modify, and replay a webpage’s JavaScript behavior directly from Firefox DevTools. Break on network requests and responses, edit, and continue. See function calls in real time - edit their output and replay them. Or ask the built-in AI agent to analyze captured output.

How we built it

Codex with test sites on Firefox developer edition

Challenges we ran into

Codex keeps thinking I'm writing malware - and the "Trusted Access for Cyber" still hasn't been approved :( Other challenges are just the complexity of the tool and requires a lot of manual testing.

Accomplishments that we're proud of

A working product - first of it's kind! All advertised features are working. Let the website breaking debugging begin

What we learned

Codex - just like a real developer - will code towards solving test cases too closely if you let it.

What's next for JS Disector

More tests to make sure functionality is solid. Real world use cases. The codebase is extremely complex and somewhat fragile. So a lot of hardening is needed. Also a new name - I'm pretty sure it's even misspelt.

Built With

Share this project:

Updates