A command-line tool that uses Joern to automatically map the attack surface of web applications. JASM analyzes source code to identify HTTP endpoints and their input parameters, producing a structured JSON report useful for security assessments.
| Framework | Language | Detection Method |
|---|---|---|
| Spring | Java | @RequestMapping, @GetMapping, @PostMapping, etc. |
| Django | Python | urls.py patterns, request.GET/POST/body usage |
| Express | Node.js | app.get(), router.post(), req.params/query/body |
- Joern - Code analysis platform (installation guide)
- Bash 4.0+
- jq (optional, for enhanced JSON output)
# Quick install (Linux/macOS)
curl -L "https://github.com/joernio/joern/releases/latest/download/joern-install.sh" -o joern-install.sh
chmod +x joern-install.sh
sudo ./joern-install.sh
# Or via Docker
docker pull ghcr.io/joernio/joerngit clone https://github.com/anthropics/jasm.git
cd jasm
chmod +x jasm# Basic usage - auto-detect framework
./jasm /path/to/your/project
# Specify output file
./jasm -o results.json /path/to/project
# Force framework type (skip auto-detection)
./jasm -f spring /path/to/spring-boot-app
./jasm -f django /path/to/django-project
./jasm -f express /path/to/node-app
# Verbose mode for debugging
./jasm -v /path/to/project
# Use existing CPG file (faster for repeated analysis)
./jasm --cpg cached.cpg.bin /path/to/project| Option | Description |
|---|---|
-h, --help |
Show help message |
-V, --version |
Show version |
-v, --verbose |
Enable verbose output |
-o, --output FILE |
Output file path (default: attack_surface.json) |
-f, --framework NAME |
Force framework: spring, django, or express |
--cpg FILE |
Use existing CPG file |
JASM produces a JSON file with the following structure:
{
"metadata": {
"tool": "jasm",
"version": "1.0.0",
"timestamp": "2026-01-14T10:30:00Z",
"target": "/path/to/project",
"framework": "spring",
"summary": {
"totalEndpoints": 12,
"byMethod": {
"GET": 5,
"POST": 4,
"PUT": 2,
"DELETE": 1
}
}
},
"endpoints": [
{
"path": "/api/users/{id}",
"method": "GET",
"handler": "com.example.UserController.getUser",
"file": "src/main/java/com/example/UserController.java",
"lineNumber": 45,
"parameters": [
{
"name": "id",
"type": "path",
"dataType": "Long",
"required": true
}
]
}
]
}| Type | Description | Framework Example |
|---|---|---|
path |
URL path parameter | @PathVariable, :id, <int:id> |
query |
Query string parameter | @RequestParam, req.query, request.GET |
body |
Request body | @RequestBody, req.body, request.body |
header |
HTTP header | @RequestHeader, req.headers |
cookie |
Cookie value | @CookieValue, req.cookies |
form |
Form data | @ModelAttribute, request.POST |
file |
File upload | request.FILES, req.files |
./jasm -v -o spring_endpoints.json ./my-spring-app
# Filter POST endpoints with jq
cat spring_endpoints.json | jq '.endpoints[] | select(.method == "POST")'./jasm -f django -o django_api.json ./my-django-project
# Count endpoints by method
cat django_api.json | jq '.metadata.summary.byMethod'./jasm ./my-express-app
# List all paths
cat attack_surface.json | jq -r '.endpoints[].path' | sort -u| Code | Meaning |
|---|---|
| 0 | Success |
| 1 | General error |
| 2 | Joern not installed |
| 3 | Framework detection failed |
| 4 | CPG generation failed |
| 5 | Query execution failed |
| 6 | Invalid arguments |
- Syntax errors: Ensure your code compiles without errors
- Memory issues: Set Java heap size:
export _JAVA_OPTIONS='-Xmx4g' - Unsupported language version: Check Joern's supported language versions
Use -f flag to manually specify the framework:
./jasm -f spring /path/to/project- Verify the target directory contains source code
- Check that the framework is correctly detected
- Use
-vfor verbose output to debug
jasm/
├── jasm # Main executable
├── lib/
│ ├── common.sh # Shared utilities
│ ├── detection.sh # Framework detection
│ ├── joern_utils.sh # Joern integration
│ ├── json_builder.sh # JSON output assembly
│ └── queries/
│ ├── spring.sc # Spring/Java query
│ ├── django.sc # Django/Python query
│ └── express.sc # Express/Node.js query
├── README.md
└── CLAUDE.md
MIT
Contributions are welcome! Please open an issue or submit a pull request.