██████╗ ██████╗ ██████╗ ███╗   ██╗ ██████╗ ███████╗
  ██╔════╝██╔═══██╗██╔══██╗████╗  ██║██╔═══██╗╚══███╔╝
  ██║     ██║   ██║██║  ██║██╔██╗ ██║██║   ██║  ███╔╝
  ██║     ██║   ██║██║  ██║██║╚██╗██║██║   ██║ ███╔╝
  ╚██████╗╚██████╔╝██████╔╝██║ ╚████║╚██████╔╝███████╗
   ╚═════╝ ╚═════╝ ╚═════╝ ╚═╝  ╚═══╝ ╚═════╝ ╚══════╝

   J S C R E D  —  JS Bundle Credential Hunter v1.0

Find hardcoded admin credentials in AI-generated website JavaScript bundles

---

🔍 What is JSCRED?

JSCRED is an open-source Python tool built for security researchers and ethical hackers to demonstrate a critical vulnerability pattern found in websites built by AI code generators (Lovable, Bolt.new, v0 by Vercel, Cursor, GitHub Copilot, etc.).

These AI-generated sites frequently ship admin credentials, API keys, and secrets hardcoded directly inside JavaScript bundles — fully exposed to anyone who opens browser DevTools.

JSCRED automates the discovery of these credentials by:

1. Fetching the admin panel page HTML
2. Extracting every JavaScript bundle URL (Webpack, Vite, Next.js chunks, etc.)
3. Async-downloading all JS bundles simultaneously
4. Running 25+ regex patterns tuned for how AI-generated code leaks secrets
5. Displaying extracted credentials in a beautiful, color-coded terminal report

---

⚠️ Disclaimer

This tool is for educational and authorized security research ONLY.

• Only test websites you own or have explicit written permission to test.
• Unauthorized access to computer systems is illegal under the CFAA, Computer Misuse Act, and equivalent laws globally.
• The author is not responsible for any misuse, damage, or illegal activity.
• By using this tool, you agree to comply with all applicable laws.

---

🎯 Why AI-Generated Sites Are Vulnerable

AI code generators (Lovable, Bolt, v0, Cursor) build functional apps fast — but routinely introduce a critical security antipattern:

// ❌ Real example found in a live Next.js admin panel (minified bundle)
"admin@company.com" === e && "password123" === p && setTimeout(() => {
  router.push("/admin/dashboard")
}, 500)

Instead of server-side authentication, the AI writes client-side credential checks — meaning the email and password live inside the JavaScript bundle, downloadable by anyone.

JSCRED finds these in seconds.

---

✨ Features

Feature	Description
🔎 JS Bundle Extraction	Discovers all <script src> files + Webpack/Vite/Next.js chunk manifests
🧠 25+ Credential Patterns	Covers assignments, comparisons, object literals, base64, env fallbacks
⚡ Async / Fast	Fetches all bundles concurrently via aiohttp
🎯 Minified Code Aware	Catches "email"===e&&"pass"===p — the real pattern AI sites use
🔐 Full Coverage	Admin creds, API keys, Supabase/Firebase tokens, MongoDB URIs, JWTs
📋 Context Snippets	Shows exactly where in the bundle the credential was found
🎨 Rich Terminal UI	Color-coded table output — looks great in demos and reels
🔓 Base64 Decode	Auto-decodes base64-encoded secrets inline

---

📦 Installation

# Clone the repository
git clone https://github.com/devixsolutions12/codnoz-jscred.git
cd codnoz-jscred

# Install dependencies (Python 3.10+ required)
pip install -r requirements.txt

---

🚀 Usage

python jscred.py <admin_panel_url>

Examples:

# Basic usage — give it any admin login page
python jscred.py https://target-site.com/admin/login

# Full URL with path
python jscred.py https://myaisite.com/admin

# Works with IP addresses too
python jscred.py http://192.168.1.100/admin

---

📸 Output

The tool runs in 5 phases, all visible in real-time:

╔══════════════════════════════════════════════╗
║  CODNOZ JSCRED — JS Credential Hunter        ║
║     AI site admin panel  →  hardcoded creds  ║
║              By @ethicalcodnoz               ║
╚══════════════════════════════════════════════╝

[→] Target Admin Panel : https://target.com/admin/login
[→] Base Domain        : https://target.com

[✓] HTML fetched — 19,181 bytes
[✓] JS bundles found: 13
[✓] Inline script blocks: 8

────────────── JS BUNDLES FOUND ──────────────
→ https://target.com/_next/static/chunks/82abf2d.js
→ https://target.com/_next/static/chunks/f689f12c6d835269.js
...

⚠  2 CREDENTIAL(S) EXTRACTED
╔══════════════════════════════════════════════════════════════╗
║  Type                        │  Value                       ║
╠══════════════════════════════╪══════════════════════════════╣
║  Hardcoded Email+Password    │  admin@site.com | pass123    ║
║  Admin Login Bypass Block    │  admin@site.com | pass123    ║
╚══════════════════════════════╧══════════════════════════════╝

---

🧩 Credential Patterns Detected

JSCRED contains 25+ patterns organized in priority order:

🔴 Minified Comparison Patterns (AI sites — highest priority)

These are the real patterns AI-generated minified bundles use:

Pattern	Example in Minified Code	Label
Full pair, left-literal	"email@x.com"===e&&"pass"===p	Hardcoded Email+Password
Full pair + redirect	"email"===e&&"pass"===p&&setTimeout(...)	Admin Login Bypass Block
Email only, left	"admin@x.com"===e	Hardcoded Email (left ===)
Email only, right	e==="admin@x.com"	Hardcoded Email (right ===)
Password via &&	&&"secretpass"===p	Hardcoded Password (&&===)
Negation check	"admin@x.com"!==e	Hardcoded Email (!==)
Special-char strings	"P@ssw0rd!"===p	Hardcoded String w/ Special Chars

🟡 Assignment Patterns (non-minified / dev builds)

Pattern	Example	Label
Admin variable	adminPassword = "secret"	Admin Password
Username var	username = "admin"	Username
Email var	adminEmail = "x@y.com"	Email Credential
Credential object	{user: "admin", password: "pass"}	Credential Object
Default creds	defaultPass = "admin123"	Default Password
Env fallback	process.env.SECRET || "fallback"	Env Fallback Hardcode
console.log leak	console.log("password", userPass)	console.log Leak

🔵 Service Credentials

Service	Pattern	Label
Supabase	SUPABASE_KEY = "eyJ..."	Supabase Credential
Firebase	FIREBASE_API_KEY = "AIza..."	Firebase Credential
MongoDB	MONGO_URI = "mongodb+srv://..."	MongoDB URI
Any DB	DATABASE_URL = "postgres://..."	Database URL
JWT	Bearer eyJ0eXAi...	Bearer JWT
API Key	API_KEY = "sk-..."	API Key
Base64 secret	atob("dXNlcjpwYXNz")	Base64 Encoded Value (auto-decoded)

---

🗂️ Project Structure

codnoz-jscred/
├── jscred.py          # Main tool
├── requirements.txt   # Python dependencies
├── LICENSE            # MIT License
└── README.md          # This file

---

🧰 Dependencies

Package	Version	Purpose
rich	>=13.0	Beautiful terminal UI, tables, progress bars
aiohttp	>=3.9	Async HTTP client for concurrent bundle fetching

Both are lightweight and install in seconds.

---

🔗 Related Tools

This tool is part of the CODNOZ security research toolkit:

Tool	Description	Repo
JSCRED (this tool)	JS bundle credential hunter	codnoz-jscred
RECON	Port scan + route buster + tech fingerprint	codnoz-recon

---

🧪 Tested Against

• ✅ Next.js (App Router + Pages Router)
• ✅ Vite + React
• ✅ Create React App
• ✅ Lovable.dev generated sites
• ✅ Bolt.new generated sites
• ✅ v0.dev (Vercel) generated sites
• ✅ Any site with Webpack/Turbopack bundles

---

📄 License

MIT — free to use, fork, and modify with attribution.

---

👤 Author

@ethicalcodnoz

Security researcher | Ethical hacker | Content creator

📌 Follow for more cybersecurity tools, reels, and open-source security projects.

---

🤝 Contributing

PRs and issues welcome.

• Found a new credential pattern in the wild? Open an issue with the JS snippet (redacted).
• Want to add support for a new AI platform's bundle format? Submit a PR.

---

⭐ Star History

If this tool helped you understand web security vulnerabilities, give it a star — it helps others find it.

---

Made with ❤️ for the cybersecurity community. Use responsibly.

Keywords: javascript-security credential-hunting web-security ethical-hacking penetration-testing ai-security next-js-security js-bundle-analysis security-research osint bugbounty lovable-security bolt-security hardcoded-credentials