Unlock Browser JS with JsRpc: A Simple WebSocket Bridge for Reverse Engineering

Introduction

JsRpc creates a WebSocket connection between a browser and a Go service, allowing the server to invoke JavaScript code via HTTP‑style endpoints. It can be used for reverse‑engineering encrypted functions or directly fetching data.

Code Structure

-- main.go (server main code)
-- resouces/JsEnv.js (client‑side JS injection)

Basic Overview

Running the server program together with the JS script enables communication; the server calls an interface, the client executes the registered JS method, and the result is returned to the server.

Implementation Details

The browser opens a WebSocket client to the server, calls server APIs, the server sends a message to the client, the client runs the specified JS, and sends the result back. The method works with HTTPS certificates and supports wss.

For HTTPS sites, a plain ws connection may cause security errors; using a local address (127.0.0.1) or wss avoids this. Without a certificate, compile main.go and use the default port 12080. With a certificate, comment out r.Run(), enable r.RunTls, set the certificate path, and use the default port 12443.

Usage

Download the compiled binaries from the release page and run the executable to start the service.

After launching, double‑click the file to start the server.

API Overview

/list

: view currently connected WebSocket services /ws: endpoint for injecting WebSocket connection into the browser /result: retrieve data (JSON format, e.g., {"group":"hhh","hello":"好困啊yes","name":"baidu","status":"200"})

Endpoints accept group and name query parameters, e.g.:

ws://127.0.0.1:12080/ws?group={}&name={}

http://127.0.0.1:12080/go?group={}&name={}&action={}¶m={}

action

is the registered method name, param is optional.

Injecting JS and Building the Communication Environment

Open JsEnv.js and paste its content into the browser console (breakpoints may need to be disabled).

Injecting WebSocket and Registering Methods

// Connect
var demo = new Hlclient("ws://127.0.0.1:12080/ws?group=hhh&name=baidu");
// Register a method (first arg is method name, second is function)
// param is optional
 demo.regAction("hello", function(resolve, param) {
    var c = "好困啊" + param;
    resolve(c);
});

Accessing the API to Retrieve Data

http://127.0.0.1:12080/go?group=hhh&name=baidu&action=hello¶m=yes
// Returns JSON:
{
  "group":"hhh",
  "hello":"好困啊yes",
  "name":"baidu",
  "status":"200"
}

Conclusion

JsRpc enables a browser‑to‑Go WebSocket bridge that can execute injected JavaScript and return results, useful for reverse engineering, decryption, or data scraping. Try it out and explore further applications.