add js-audit preset, streamline trufflehog HTTP ingestion

[liquidsec]

Summary

• New bbot/presets/web/js-audit.yml (invoked as -p js-audit) for hunting leaked credentials and vulnerable libraries in client-side JavaScript. Enables http, trufflehog, badsecrets, retirejs, robots, wayback.
• Trufflehog now streams HTTP_RESPONSE and RAW_TEXT bodies to trufflehog stdin instead of writing them to a tempfile.
• Trufflehog FINDINGs from HTTP_RESPONSE parents now carry the source URL in data["url"], so an operator can trace a leaked secret back to the exact JS bundle.

Why

BBOT has no native workflow for hunting secrets in client-side JavaScript. Trufflehog already watches HTTP_RESPONSE but it's code-enum-flagged and doesn't get pulled in by any web-focused preset. Building js-audit surfaced two latent issues in the trufflehog module that made the output unusable for this workflow:

1. Every HTTP_RESPONSE body was written to ~/.bbot/temp/xxx before scanning. Wasted disk I/O per response, doubles up with body-spill in configs that use it, and the tempfile path leaked into source_metadata in the FINDING description.
2. The FINDING did not carry the URL of the response the secret came from. Operators saw Details: [{'Data': {'Filesystem': {'file': '/home/liquid/.bbot/temp/2av150lh9hz23qxjpr6r', 'line': 13}}}] with no way to correlate that to the specific JS file.

What changed

trufflehog module

• For HTTP_RESPONSE and RAW_TEXT: switched from trufflehog filesystem <tempfile> to trufflehog stdin, piped via run_process_live(..., input=body). No tempfile. Details: field now shows Stdin: {} instead of a tempfile path.
• For HTTP_RESPONSE parents: FINDING now includes data["url"] from the parent HTTP_RESPONSE.
• Switched self.helpers.run_live to self.run_process_live so the trufflehog subprocess is tracked in _proc_tracker and cleaned up on scan shutdown, matching the pattern used by fingerprintx, gowitness, and nuclei.
• Dropped the stale comment referencing trufflehog issue ASN module rewrite #162 (stdin has been supported for years).

Preset

• bbot/presets/web/js-audit.yml. Config: trufflehog.only_verified: false (broad detection), robots.include_sitemap: true (sitemaps often enumerate JS bundle paths), wayback.urls: true + archive: true (secrets in deprecated/archived JS is a classic hunting ground).

[github-actions]

📊 Performance Benchmark Report

Comparing dev (baseline) vs js-audit (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	4.33ms	4.38ms	+1.0% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	21.63ms	17.84ms	-17.5% 🟢🟢	🚀
Large Closest Match Lookup	366.09ms	361.77ms	-1.2% ⚪	✅
Realistic Closest Match Workload	194.44ms	199.30ms	+2.5% ⚪	✅
Event Memory Medium Scan	1404 B/event	1402 B/event	-0.2% ⚪	✅
Event Memory Large Scan	1527 B/event	1527 B/event	+0.0% ⚪	✅
Event Validation Full Scan Startup Small Batch	403.96ms	419.59ms	+3.9% ⚪	✅
Event Validation Full Scan Startup Large Batch	546.30ms	544.93ms	-0.3% ⚪	✅
Make Event Autodetection Small	26.19ms	26.18ms	-0.0% ⚪	✅
Make Event Autodetection Large	267.09ms	267.44ms	+0.1% ⚪	✅
Make Event Explicit Types	11.54ms	11.64ms	+0.9% ⚪	✅
Excavate Single Thread Small	4.251s	4.171s	-1.9% ⚪	✅
Excavate Single Thread Large	9.995s	9.851s	-1.4% ⚪	✅
Excavate Parallel Tasks Small	4.422s	4.334s	-2.0% ⚪	✅
Excavate Parallel Tasks Large	6.531s	6.478s	-0.8% ⚪	✅
Intercept Throughput Small	875.33ms	875.28ms	-0.0% ⚪	✅
Intercept Throughput Medium	871.25ms	922.23ms	+5.9% ⚪	✅
Dns Throughput Quiet	2.784s	2.802s	+0.7% ⚪	✅
Dns Throughput Loaded	1.856s	1.953s	+5.2% ⚪	✅
Dns Throughput Inherited	2.566s	2.448s	-4.6% ⚪	✅
Is Ip Performance	2.36ms	2.32ms	-1.6% ⚪	✅
Make Ip Type Performance	236.01µs	242.48µs	+2.7% ⚪	✅
Mixed Ip Operations	2.48ms	2.42ms	-2.5% ⚪	✅
Memory Use Web Crawl	1.0 MB	1.0 MB	+0.0% ⚪	✅
Memory Use Subdomain Enum	28.3 MB	28.3 MB	+0.0% ⚪	✅
Memory Use Deep Chain	5.0 MB	5.0 MB	+0.0% ⚪	✅
Memory Use Parallel Chains	10.6 MB	11.1 MB	+5.5% ⚪	✅
Scan Throughput 100	2.882s	2.823s	-2.0% ⚪	✅
Scan Throughput 1000	21.235s	20.627s	-2.9% ⚪	✅
Typical Queue Shuffle	5.37µs	5.53µs	+2.9% ⚪	✅
Priority Queue Shuffle	26.20µs	26.25µs	+0.2% ⚪	✅

🎯 Performance Summary

+ 1 improvement 🚀
  30 unchanged ✅

🔍 Significant Changes (>10%)

• Bloom Filter Large Scale Dns Brute Force: 17.5% 🚀 faster

---

🐍 Python Version 3.11.15

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90%. Comparing base (92549fa) to head (2016c4e).
⚠️ Report is 12 commits behind head on dev.

Additional details and impacted files

@@          Coverage Diff          @@
##             dev   #3297   +/-   ##
=====================================
+ Coverage     90%     90%   +1%     
=====================================
  Files        450     450           
  Lines      46285   46308   +23     
=====================================
+ Hits       41546   41568   +22     
- Misses      4739    4740    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.