.. _jshooks: JS Hooks ======== Starting from version 0.8.2, Thug features JavaScript hooks. This feature could be quite useful if you are required to load your own JavaSript code in a page to be analyzed. For instance, if you are interested into scanning JavaScript libraries to detect known vulnerabilities (take a look at RetireJS [#f1]_ for a great example of that) this feature could be quite handy. Defining and using JS hooks is extremely simple. If you need to execute just one JavaScript file just drop it in the directory */etc/thug/hooks* and you are done. If you need to execute more than one Javascript file, be aware that Thug can enforce the order of execution of such files. All you need to do is to sort the file names in alphabetical order and Thug will execute them in that order. A good practice I would like to suggest is to prefix each file name with a numerical prefix (and remember that the string '10' is lesser than '9' so use '09' instead if you have to execute more than nine hooks). Let's take a look at an example. We will make use of the following simple page and overwrite the eval method. .. code-block:: javascript `_ is a scanner detecting the use of JavaScript libraries with known vulnerabilities