Portuguese / PT-BR README

EntroJS
JavaScript exposure hunting by EntroVyx.

Overview

EntroJS is a practical JavaScript scanner for remote bundles, discovered script assets, local files, and pasted source. It focuses on exposed secrets, dangerous client-side patterns, high-entropy strings, source map signals, recon-relevant endpoints, and readable triage.

The workflow is simple:

• run a direct scan or spider a target
• watch the live progress panel
• land in a dedicated HTML report automatically
• keep JSON available for export or pipelines

If Ollama is configured, EntroJS can run a second local validation pass on sensitive findings. If it is not configured, scanning still works normally.

Installation

go install -v github.com/EntroVyx/EntroJS/cmd/entrojs@latest

Run:

entrojs

Open:

http://127.0.0.1:8080

Scan Modes

• Single URL for a direct JavaScript file
• Spider mode for same-origin page crawling and script discovery
• Batch mode for multiple JavaScript URLs
• Upload mode for local bundles
• Raw mode for pasted source

Optional AI Validation

EntroJS supports optional local validation through Ollama.

• no Ollama configured: deterministic scan only
• Ollama configured: deterministic scan plus local validation
• if Ollama fails: the base scan still returns results

Recommended lightweight model:

ollama pull qwen3:4b

Web UI

The embedded interface is intentionally simple:

• compact input flows
• visible progress steps during scan and spider runs
• automatic redirect to a dedicated HTML report
• JSON report download from the final report page
• optional Ollama endpoint and model settings

CLI

Analyze a remote file:

entrojs -url https://target.tld/static/app.js

Analyze a local file:

entrojs -file bundle.js

Analyze stdin:

cat bundle.js | entrojs -stdin

Run with local AI validation:

entrojs -url https://target.tld/app.js -use-ai -ollama-url http://127.0.0.1:11434 -ollama-model qwen3:4b

API

GET /api/health

Returns service status and version.

GET /api/settings

Returns UI defaults such as the default Ollama URL, model, and spider limit.

POST /api/analyze

Accepts:

• url
• urls
• content
• multipart file upload

Optional AI fields:

• use_ai
• ollama_url
• ollama_model

Returns a session id, structured results, and a report_url.

POST /api/spider

Crawls the target, follows same-origin pages, discovers JavaScript assets, analyzes them, and returns a report_url.

POST /api/ollama/test

Checks whether the configured Ollama endpoint is reachable and lists available local models.

Reports

Each scan creates a dedicated report session with:

• severity summary
• per-file risk score
• grouped findings
• compact context snippets
• spider summary when applicable
• JSON export

Configuration

Variable	Default	Purpose
ENTROJS_HOST	0.0.0.0	HTTP listen host
ENTROJS_PORT	8080	HTTP listen port
ENTROJS_MAX_FILE_SIZE	20971520	Max file size in bytes
ENTROJS_FETCH_TIMEOUT	45	Fetch timeout in seconds
ENTROJS_FETCH_MAX_RETRIES	2	Retry count
ENTROJS_FETCH_RETRY_DELAY	2	Retry delay in seconds
ENTROJS_ENTROPY_THRESHOLD	4.5	Shannon entropy threshold
ENTROJS_OLLAMA_URL	http://127.0.0.1:11434	Default Ollama endpoint
ENTROJS_OLLAMA_MODEL	qwen3:4b	Default Ollama model
ENTROJS_MAX_SPIDER_PAGES	10	Max internal pages for spider mode

Repository Layout

cmd/entrojs/        # CLI + web entrypoint
internal/ai/        # Optional Ollama validation
internal/analyzer/  # Fetching, regex, entropy, spider, scoring
internal/app/       # HTTP handlers and report generation
internal/config/    # Environment-driven configuration
internal/models/    # Shared API and result models
web/                # Embedded UI
assets/             # Branding assets

Responsible Use

Use EntroJS only on assets you own or are explicitly authorized to test.