NEXA is a fast, passive credential and secret scanner for frontend web applications. It crawls target sites and hunts for exposed API keys, hardcoded credentials, auth tokens, and secrets buried inside JavaScript bundles, source maps, HTML, and server-side rendered framework state payloads.

Built for bug bounty hunters and pentesters. Works standalone or chained with subfinder, httpx, and jq.

• Credential pair detection — captures both username/keyId and password/secret fields together (e.g. wsApiKeyId: cfbenchmarksws + wsApiKeyPassword: uuid)
• All major JS frameworks — extracts and scans __NEXT_DATA__, __NUXT__, __remixContext, __GATSBY__, ng-state, __INITIAL_STATE__, SvelteKit, Astro, and generic application/json script tags
• 26 targeted patterns — AWS, Google, GitHub, Stripe, Slack, SendGrid, Twilio, Sentry, JWT, Basic Auth, hardcoded passwords, and more
• High-entropy string detection — catches unknown secrets via Shannon entropy scoring with credential keyword context
• Source map discovery — publicly accessible .map files that leak original source code
• Framework fingerprinting — Next.js, Nuxt, React, Vue, Angular, Vite, Svelte, Astro
• Subdomain discovery — passive enumeration via crt.sh + HackerTarget
• WAF detection + bypass mode — UA rotation, jitter, cookie persistence, Sec-Fetch headers
• CORS misconfiguration — detects reflected origins with credentials
• Pipe-friendly — progress to stderr, findings to stdout, JSONL for chaining
• Passive only — no state-changing requests

Requirements: Python 3.11+ and pipx (brew install pipx on macOS)

pipx install git+https://github.com/dalpan/nexa.git

Or clone and install locally:

git clone https://github.com/dalpan/nexa
cd nexa
make install

nexa will be available system-wide — no venv needed.

nexa upgrade

nexa scan <target>

# Basic scan
nexa scan target.com

# Deeper crawl
nexa scan target.com --depth 3 --max-pages 100

# Skip subdomain discovery for faster scans
nexa scan target.com --no-subdomain

# Show only HIGH and above
nexa scan target.com --min-severity HIGH

# WAF bypass mode
nexa scan target.com --waf-bypass

# Save JSON + CSV report
nexa scan target.com --output-dir ./results --export-csv

# Check version
nexa version

NEXA reads targets from stdin when no target argument is given — progress to stderr, findings to stdout.

# subfinder → httpx → nexa
subfinder -d target.com | httpx | nexa scan

# Scan from a list file
nexa scan --list targets.txt

# Filter CRITICAL findings with jq
subfinder -d target.com | httpx | nexa scan --format jsonl \
  | jq 'select(.severity == "CRITICAL")'

# Extract values only
nexa scan target.com --format jsonl \
  | jq -r 'select(.severity == "HIGH" or .severity == "CRITICAL") | "\(.title): \(.value)"'

NEXA automatically extracts and scans embedded JSON payloads from all major SSR frameworks — the most common place credentials accidentally get exposed on the frontend:

Reports (JSON + Markdown) are saved automatically to ./nexa-output/<target>_<timestamp>/.

make dev    # set up local .venv
make test   # run test suite

NEXA is intended for authorized security assessments only. Only scan targets you have explicit permission to test. The authors are not responsible for misuse.