Detect Dynamic JS
Summary: PortSwigger's BApp Store lists DetectDynamicJS, a Burp Suite extension by Veit Hailperin (version 0.10, last updated 17 December 2018) that compares JavaScript files to detect dynamically generated content and content only accessible to authenticated users. Triggered by a passive scan of JavaScript requested as an authenticated user, it sends one or sometimes two requests per script without cookies to fetch the unauthenticated version, and reports an issue in the Target tab when the same script contains differing content.
What's compelling: The extension exists because dynamically generated scripts can carry data with user or session information, which it then checks for potential leakage - a reminder that authenticated JavaScript can ship session data to anyone who requests the same file without cookies.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026