Firefox Browser Add-ons
  • Extensions
  • Themes
    • for Firefox
    • Dictionaries & Language Packs
    • Other Browser Sites
    • Add-ons for Android
Log in
Preview of JSONPeek

JSONPeek by Hacks and Hops

Passively identify JSONP endpoints as you browse with the ability to send suspected endpoints to an exploit server for validation.

0 (0 reviews)0 (0 reviews)
20 Users20 Users
You’ll need Firefox to use this extension
Download Firefox and get the extension
Download file

Extension Metadata

Screenshots
The JSONPeek popupThe exploit server testing a provided URLAn alert box firing which indicates the endpoint is in fact JSONP
About this extension
Code
This addon is free and open-source software (FOSS) all code can be found here: https://github.com/ACK-J/JSONPeek/
Please report your bugs or feature requests in a GitHub issue instead of in a review.

Test if it works!
https://www.w3schools.com/js/tryit.asp?filename=tryjson_jsonp_callback

This addon passively listens for network requests which include GET parameters commonly used by JSONP endpoints. The extension popup will show you any of these detected requests. Clicking on a request in the popup will open the JSONP endpoint in a new tab for you to play around with. Additionally, there is an "exploit" button that sends the suspected JSONP url to my webserver to check if it is exploitable. The source code for the webserver can be found HERE. Multiple proof of concepts are attempted with check marks indicating success and an X indicating failure.

Why do I want to find JSONP endpoints?
The most common way to bypass a content security policy (CSP) is by finding a JSONP endpoint on a trusted domain within the CSP. JSONP takes advantage of the fact that the same-origin policy does not prevent execution of external <script> tags. Usually, a <script src="some/js/file.js"> tag represents a static script file. But you can just as well create a dynamic API endpoint, say /userdata, and have it accept a query parameter (such as ?callback=CALLBACK) which dynamically specifies a JavaScript function.

When would I need a CSP Bypass?
A Content Security Policy (CSP) bypass may be necessary in specific scenarios, typically related to web security testing or development. CSP is a security feature that helps prevent a range of attacks like Cross-Site Scripting (XSS), data injection attacks, and clickjacking by controlling which resources the browser is allowed to load and execute.

Donations
  • Monero Address: 89jYJvX3CaFNv1T6mhg69wK5dMQJSF3aG2AYRNU1ZSo6WbccGtJN7TNMAf39vrmKNR6zXUKxJVABggR4a8cZDGST11Q4yS8
Rated 0 by 0 reviewers
Sign in to rate this extension
There are no ratings yet

Star rating saved

5
0
4
0
3
0
2
0
1
0
No reviews yet
Permissions and dataLearn more

Required permissions:

  • Access browser tabs
  • Access your data for all websites
More information
Add-on Links
  • Support site
Version
1.3
Size
78.46 KB
Last updated
a month ago (Jul 28, 2025)
Related Categories
  • Web Development
  • Privacy & Security
License
GNU General Public License v3.0 only
Version History
  • See all versions
Add to collection
Report this add-on
Release notes for 1.3
  • removed reliance on jsonpeek.com
More extensions by Hacks and Hops
  • There are no ratings yet

  • There are no ratings yet

  • There are no ratings yet

  • There are no ratings yet

  • There are no ratings yet

  • There are no ratings yet

Go to Mozilla’s homepage

Add-ons

  • About
  • Firefox Add-ons Blog
  • Extension Workshop
  • Developer Hub
  • Developer Policies
  • Community Blog
  • Forum
  • Report a bug
  • Review Guide

Browsers

  • Desktop
  • Mobile
  • Enterprise

Products

  • Browsers
  • VPN
  • Relay
  • Monitor
  • Pocket
  • Bluesky (@firefox.com)
  • Instagram (Firefox)
  • YouTube (firefoxchannel)
  • Privacy
  • Cookies
  • Legal

Except where otherwise noted, content on this site is licensed under the Creative Commons Attribution Share-Alike License v3.0 or any later version.