zlacker

>Can anybody recommend a tool to look what Javascript code loaded by a certain page is doing?

Almost all modern browsers have debug panels that will list all of the requests made by a page, assets cached, cookies and local db, and of course it's trivial to just view the source of a site and read the javascript if it isn't compressed.

>>krapp+(OP)
Yes, I am aware of dev tools. I use them to look at network requests or to "steal" my own credentials for curl usage.

Haven't really used the Javascript debugger, but my guess would be completely infeasible to follow everything a random "modern" Web site might do. And as you say some Javascript might be compressed or obfuscated. What I really would want is a somewhat higher level / more filtered approach: Like strace lets me just trace file operations for example.

>>usr110+Q
I'm not sure if it always works on all APIs or browsers, but you can wrap and replace DOM API objects with logging proxies.

Additionally, you can set breakpoints on event handlers and Chromium has deobfuscation built in. You can usually tell approximately what's going on by stepping through the code and watching the variables in local scope.

>>TJSome+V4
> but you can wrap and replace DOM API objects with logging proxies.

Right, so you are describing the implementation of the tool I was looking for. Obviously I don't want to do that manually while tracing a page.