skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

competition-bundle-sourcemap-recovery

Reconstructs runtime structure from served bundles, source maps, and chunk manifests.

21|8|Updated Aug 3, 2026
Search Tags:#javascript#bundle analysis#web security#ctf#reverse engineering#deobfuscation#source maps
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill competition-bundle-sourcemap-recovery-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: competition-bundle-sourcemap-recovery
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/CTF-Sandbox-Orchestrator/competition-bundle-sourcemap-recovery
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill competition-bundle-sourcemap-recovery-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When a CTF web challenge's real logic lives in minified production bundles rather than readable source, analysts waste time guessing at hidden routes, API endpoints, and loader behavior. This Skill provides a repeatable workflow for recovering runtime truth from built frontend artifacts. ## Core Features & Use Cases - Served Artifact Mapping: Records entry HTML, script tags, build manifests, chunk registries, and source map URLs with hash and route ownership tied together. - Runtime Structure Reconstruction: Follows bootstrap code, chunk loaders, module registries, and string decoders to recover hidden routes, API calls, and feature flags. - Decisive Path Reduction: Compresses findings into the smallest asset-to-runtime sequence proving the exploitable behavior. - Use Case: During a CTF web challenge, the served JavaScript is obfuscated and the repository source does not match production. Use this Skill to trace the chunk loader, decode the route manifest, and expose a hidden admin panel endpoint. ## Quick Start After the ctf-sandbox-orchestrator is active, ask it to reconstruct the served bundle structure and recover hidden routes or endpoints from the source maps and chunk manifests.

Frequently Asked Questions about competition-bundle-sourcemap-recovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover hidden routes from a minified JavaScript bundle?▼

Start from the build manifest and chunk registry rather than the minified code itself. Follow the bootstrap loader and module registry, then use source maps and stable symbol clusters to recover route names, API calls, and feature flags.

How to use source maps to analyze obfuscated frontend code?▼

Locate source map URLs from the served artifact set, then map emitted chunks back to original module names and symbols. Combine this with loader flow tracing to prove which bundle path actually executes at runtime.

Can I trust repository source code instead of the served bundle?▼

No, repository source often drifts from the actively served artifact set. This workflow keeps served artifact truth separate from checked-in source unless parity is explicitly proven, since build-time intent may differ from deployed output.

When should this skill be used in a CTF workflow?▼

Use it only after the ctf-sandbox-orchestrator has established sandbox assumptions, node ownership, and evidence priorities. It is a downstream specialization for challenges where decisive behavior lives in built frontend assets.

What are the limitations of bundle and sourcemap recovery?▼

Recovery fails when source maps are absent and string decoding is heavily obfuscated, or when the weakness actually lives in SSR or template enforcement. In those cases the workflow hands back to a template-render focused skill.

Related Skills

Explore More Software Engineering Skills→
xjtu-wangxjtu-wang
4

competition-identity-windows

Trace identity flows, tickets, and Windows host artifacts across sandbox-linked nodes.

Community
Advanced
kpabkpab

ctf-web

Exploit web vulnerabilities like XSS, SQLi, SSTI, and SSRF in CTF challenges.

Community
Advanced
warterbiliwarterbili

mitm-capture

Intercept and analyze Android and iOS mobile app network traffic with mitmproxy.

Community
Intermediate
RoxabiRoxabi
9

react-best-practices

Analyze React and Next.js codebases against 58 performance optimization rules.

Official
Advanced