OPEN SOURCE · RUST · v0.1.3

rsray

Extract endpoints from JavaScript bundles and websites. The real attack surface of a JS-heavy site is rarely in its navigation — it is buried in bundles, chunks and source maps. rsray X-rays them and hands you the map.

GitHub crates.io Release v0.1.3

Install

cargo install rsray

rsray https://example.com --json -o endpoints.json
rsray bundle.js --interesting-only --urls

Only use rsray on sites you own or are authorised to test.

What it does

Hidden API surface

Finds API, page, static, external and WebSocket endpoints buried in JS bundles, chunks and source maps — not just what is linked in navigation.

Flagged interesting routes

Admin, internal, debug, test, staging, dev, private, beta, backup and parameterised routes are flagged so recon starts with the interesting ones.

Real parsing, not just regex

A regex/tokenizer pass plus SWC real parsing, with string concatenation and template-literal resolution and base-URL joining.

Whole-site crawl

Crawls internal pages, sitemap.xml and robots.txt, follows JS chunks, fetches source maps and Next.js build data.

Works on authenticated targets

Repeatable headers, cookies and proxy support, with retries and delays for rate-limited targets.

Output for the next tool

Grouped text, JSON, CSV, full URLs for httpx-style chaining, quiet mode and wordlist output.

Sample output

API (5)
  /api/v1/users
  /api/v1/admin/users
  /api/v1/internal/debug
  /api/v1/users/{userId}/orders
  /api/v2/orders
Page (1)
  /products
External (1)
WebSocket (1)

Sample from the project's test fixture. Inputs supported: local files and directories, JS URLs, whole websites, stdin lists, HAR files and TOML config.