Skip to main content
Domain Scan is the primary scan type in Jsmon. It takes a domain name as input and automatically crawls the entire domain to discover URLs, JavaScript files, API endpoints, and other web assets. It then analyzes everything it finds for vulnerabilities, leaked secrets, and reconnaissance data.

​
How to Run a Domain Scan

  1. Navigate to the Scans page in your workspace
  2. Ensure Domain Scan is selected (it’s the default scan type)
  3. Enter a domain in the input field (e.g., example.com)
  4. Optionally configure scan options by clicking Options (Depth, Headers, Extensions)
  5. Click the Start Scan button

​
What Gets Scanned

A domain scan discovers and analyzes:
  • All accessible web pages and URLs on the domain
  • JavaScript files and their contents
  • API endpoints and routes
  • HTTP response headers
  • Form parameters and query strings
  • External resources and dependencies

​
Scan Results

After a scan completes, click on it in the scan list to view results in the detail panel. Results are organized into three tabs:

​
Overview

The Overview tab provides a high-level summary with cards showing:
  • API Endpoints — Number of API endpoints discovered
  • URLs Scanned — Total URLs analyzed
  • Issues — Number of vulnerabilities found
  • PII Data — Personally identifiable information detected
Below the summary cards, a list of discovered endpoints is displayed.

​
Secrets

The Secrets tab shows any leaked API keys, tokens, credentials, or other sensitive data found during the scan.

​
Reconnaissance

The Reconnaissance tab displays all discovered assets organized into categories (see the Reconnaissance section for details on each category).

​
Additional Actions

From the scan detail panel, you can:
  • Rescan — Run the scan again to check for changes
  • Download — Export the scan results
  • View All Versions — Access previous scan results using the version dropdown