Home

Relwarc is a client-side JavaScript code analyzer for discovering server HTTP endpoints.

Crawlers discover HTTP requests by actively interacting with web pages. Relwarc does the opposite: it refrains from page interaction and looks at the source code itself. It uses a static analysis algorithm for client-side JS for discovering HTTP requests sent from that JS and, thus, finding server endpoints accessed by the code. Relwarc can be used as a part of a web security scanner as a standalone tool for web security assessment/pentest.

We wrote a couple of blog posts that describe the algorithm in a beginner-friendly way. Check them out here.

The algorithm implementation is published in this repo (the repo containing this wiki). Relwarc is also available as a free online service: https://relwarc.solidpoint.net/