# JSONPeek

> Passively identify JSONP endpoints as you browse with the ability to send suspected endpoints to an exploit server for validation.

Canonical page: [https://chrome-stats.com/d/jsonpeek](https://chrome-stats.com/d/jsonpeek)

## Overview

- **ID:** `jsonpeek`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Available
- **Publisher:** Hacks and Hops
- **Category:** web-development,privacy-security
- **Daily users:** 19
- **Weekly downloads:** 3
- **Version:** 1.3
- **Last updated:** 2025-07-28
- **First published:** 2024-12-18
- **Size:** 78 KB
- **Data as of:** 2026-09-08
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/jsonpeek/)
- **Website:** [https://github.com/ACK-J/JSONPeek](https://github.com/ACK-J/JSONPeek)

## Description

<b>Code</b>
This addon is free and open-source software (FOSS) all code can be found here: <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/2f81cb690f97688a0c6905a16d1b6494054f2af8ead42e3583512e3dbf88f9cb/https%3A//github.com/ACK-J/JSONPeek/" rel="nofollow">https://github.com/ACK-J/JSONPeek/</a>
Please report your bugs or feature requests in a GitHub issue instead of in a review.

<b>Test if it works! </b>
<a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/69749372b593f167e9ce2eb5b10649f13f7bf8f9ecdff03153f774de22b62abe/https%3A//www.w3schools.com/js/tryit.asp%3Ffilename=tryjson_jsonp_callback" rel="nofollow">https://www.w3schools.com/js/tryit.asp?filename=tryjson_jsonp_callback</a>

This addon passively listens for network requests which include GET parameters commonly used by JSONP endpoints. The extension popup will show you any of these detected requests. Clicking on a request in the popup will open the JSONP endpoint in a new tab for you to play around with. Additionally, there is an "exploit" button that sends the suspected JSONP url to my webserver to check if it is exploitable. The source code for the webserver can be found <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/55c77b14c88b7db2f79114a504ebd173e0345bc261dfaeadb20f80659b754980/https%3A//github.com/ACK-J/JSONPeek/blob/main/jsonpeek-webserver.py" rel="nofollow">HERE</a>. Multiple proof of concepts are attempted with check marks indicating success and an X indicating failure.

<b>Why do I want to find JSONP endpoints?</b>
The most common way to bypass a content security policy (CSP) is by finding a JSONP endpoint on a trusted domain within the CSP. <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/850bf77b2a4ecb2e1c58aa68069f90bbdd3f34788796025c7b633bdddda61920/https%3A//dev.to/benregenspan/the-state-of-jsonp-and-jsonp-vulnerabilities-in-2021-52ep" rel="nofollow">JSONP</a> takes advantage of the fact that the same-origin policy does not prevent execution of external <b>&lt;script&gt;</b> tags. Usually, a <b>&lt;script src="some/js/file.js"&gt;</b> tag represents a static script file. But you can just as well create a dynamic API endpoint, say <b>/userdata</b>, and have it accept a query parameter (such as <b>?callback=CALLBACK</b>) which dynamically specifies a JavaScript function. 

<b>When would I need a CSP Bypass?</b>
A Content Security Policy (CSP) bypass may be necessary in specific scenarios, typically related to web security testing or development. CSP is a security feature that helps prevent a range of attacks like Cross-Site Scripting (XSS), data injection attacks, and clickjacking by controlling which resources the browser is allowed to load and execute. 

<b>Donations</b>
<ul><li>Monero Address: <b>89jYJvX3CaFNv1T6mhg69wK5dMQJSF3aG2AYRNU1ZSo6WbccGtJN7TNMAf39vrmKNR6zXUKxJVABggR4a8cZDGST11Q4yS8</b></li></ul>

## Rankings

- #25,193 — Overall
- #84 — json
- #142 — week
- #191 — identify

## Permissions and access

### Permissions

- `tabs`
- `webRequest`
- `webRequestBlocking`
- `storage`
- `activeTab`
- `<all_urls>`

## Safety

- **Risk impact:** High risk impact
- **Risk likelihood:** Moderate risk likelihood

### Analysis details

- Grants access to browser tabs, which can be used to track user browsing habits and history, presenting a privacy concern.
- This extension has low user count. Unpopular extensions may not be stable or safe.

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [JSON Viewer+](https://chrome-stats.com/d/json-viewer-plus) — 1 users
- [JsonPeek](https://chrome-stats.com/d/jsonpeekk)
- [JSON Viewer](https://chrome-stats.com/d/json-viewer-dev) — 36 users
- [Endpoint Hunter](https://chrome-stats.com/d/endpoint-hunter) — 10 users
- [JMP web helper](https://chrome-stats.com/d/jmp-webext) — 1 users, 5.00 / 5
- [JS Analyzer](https://chrome-stats.com/d/js-analyzer) — 42 users
- [JsonDiscovery](https://chrome-stats.com/d/jsondiscovery) — 160 users, 5.00 / 5
- [Port Authority](https://chrome-stats.com/d/port-authority) — 26,684 users, 4.64 / 5
- [NOAuth](https://chrome-stats.com/d/noauth) — 15 users
- [JSON Viewer Pro By PatilWeb](https://chrome-stats.com/d/json-viewer-pro-by-patilweb) — 11 users, 2.00 / 5
- [EndPointHunterV2](https://chrome-stats.com/d/endpointhunterv2) — 9 users
- [Penetration Testing Kit](https://chrome-stats.com/d/penetration-testing-kit) — 633 users, 4.71 / 5

---

Source: [Chrome-Stats](https://chrome-stats.com/d/jsonpeek)