<commit_before>---
layout: post
title: "JSMon: Automated JavaScript file monitoring"
categories: hacking pentesting bugbounty recon web js
---

## JSMon
Today I'm proud to release JSMon, an online change monitoring tool for javascript files!

To find new bugs quickly, it is a **key capability** to be able to **identify new features** and changed code as soon as they are pushed to the public. In modern web applications, features are typically implemented with javascript - making JS files a prime target for monitoring!

The idea for this tool is to continuously fetch a given list of javascript files, while keeping a database of all seen versions of those files. When a new version appears, **JSMon** saves the new version of the file, and notifies the user via IM using the Telegram API. The notification includes a beautified diff, so that one can easily spot changes even in minified code.
Continuous scanning is realized by simply running the script via cronjobs. 

When a monitored file changes, JSMon will send you a notification that looks like this:

![](assets/jsmontelegram.png)

As you can see, it tells you not only what file changed, but also the filesize, and a ``diff.html`` file! This diff file contains a nice view of all changes to the javascript file that you are monitoring!
The diff looks like this:

![](assets/jsmondiff.png)

One cool thing: Even for minified scripts a good looking diff is generated, by beautifying the script files!

**JSmon** includes a `downloads/` directory for the downloaded files, a `targets/` directory for lists of urls to fetch, and a `jsmon.json` file that serves as the database connecting the target urls to downloaded file

### Example
<commit_msg>title<commit_after>---
layout: post
title: "JSMon: Automated JavaScript file monitoring"
categories: hacking pentesting bugbounty recon web js
---

## JSMon: Automated JavaScript File Monitoring
Today I'm proud to release JSMon, an online change monitoring tool for javascript files!

To find new bugs quickly, it is a **key capability** to be able to **identify new features** and changed code as soon as they are pushed to the public. In modern web applications, features are typically implemented with javascript - making JS files a prime target for monitoring!

The idea for this tool is to continuously fetch a given list of javascript files, while keeping a database of all seen versions of those files. When a new version appears, **JSMon** saves the new version of the file, and notifies the user via IM using the Telegram API. The notification includes a beautified diff, so that one can easily spot changes even in minified code.
Continuous scanning is realized by simply running the script via cronjobs. 

When a monitored file changes, JSMon will send you a notification that looks like this:

![](assets/jsmontelegram.png)

As you can see, it tells you not only what file changed, but also the filesize, and a ``diff.html`` file! This diff file contains a nice view of all changes to the javascript file that you are monitoring!
The diff looks like this:

![](assets/jsmondiff.png)

One cool thing: Even for minified scripts a good looking diff is generated, by beautifying the script files!

**JSmon** includes a `downloads/` directory for the downloaded files, a `targets/` directory for lists of urls to fetch, and a `jsmon.json` file that serves as the database connecting the target urls to downloaded file

### Example

{'fraction_non_alphanumeric': 0.0542658154381892, 'fraction_numerical': 0.0, 'mean_word_length': 4.641571194762684, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '373693', 'n_tokens_mistral': 872, 'n_tokens_neox': 828, 'n_words': 540}