🔐 Hardcoded Token Hunter

⚡ Detect Hardcoded Tokens & Secrets in JavaScript Files

---

Automatically find exposed API keys, tokens, and secrets while browsing

---

📋 About

Hardcoded Token Hunter is a powerful Chrome extension designed for bug bounty hunters and security researchers. It automatically scans JavaScript files for hardcoded secrets, API keys, tokens, and sensitive data that shouldn't be exposed in client-side code.

---

⚡ Features

🔍 Token Detection ✅ AWS Access Keys & Secret Keys ✅ Google API Keys & OAuth ✅ GitHub/GitLab Tokens ✅ Stripe API Keys ✅ Firebase Credentials ✅ JWT Tokens ✅ Private Keys (RSA/SSH) ✅ Database Connection Strings ✅ Slack Webhooks/Tokens ✅ Twilio API Keys ✅ SendGrid API Keys ✅ Mailgun API Keys ✅ And 50+ more patterns!

🛠️ Advanced Features 🔄 Auto Mode: Passive scanning while browsing 🎯 Manual Mode: On-demand deep scanning 🪣 S3 Bucket Takeover Detection 🕷️ Deep Crawler: Follow JS imports ✅ Token Validation: Verify if tokens are active 💬 Discord Alerts: Real-time webhook notifications 📊 History Dashboard: Track all findings ⚙️ Customizable: Add your own regex patterns

---

🎯 Detected Secrets

Category	Patterns
Cloud Providers	AWS, GCP, Azure, DigitalOcean, Heroku
Payment	Stripe, PayPal, Square, Braintree
Communication	Twilio, SendGrid, Mailgun, Slack
Database	MongoDB, PostgreSQL, MySQL, Redis
Authentication	JWT, OAuth, API Keys, Bearer Tokens
Version Control	GitHub, GitLab, Bitbucket
CI/CD	Travis CI, CircleCI, Jenkins
Other	Firebase, Algolia, Mapbox, Sentry

---

🚀 Installation

# 1. Clone this repository
git clone https://github.com/KingOfBugbounty/Hardcoded-Token-Hunter.git

# 2. Open Chrome
chrome://extensions/

# 3. Enable "Developer mode" (top right corner)

# 4. Click "Load unpacked"

# 5. Select the cloned folder

# 6. Start hunting! 🎯

---

📖 How to Use

🔄 Auto Mode (Passive)

1️⃣  Enable Auto Mode in settings
         ↓
2️⃣  Browse websites normally
         ↓
3️⃣  Extension scans JS files automatically
         ↓
4️⃣  Get notified when secrets are found
         ↓
5️⃣  Check findings in the popup dashboard

🎯 Manual Mode (Active)

1️⃣  Navigate to target website
         ↓
2️⃣  Click extension icon
         ↓
3️⃣  Click "Deep Scan" button
         ↓
4️⃣  Extension crawls all JS files
         ↓
5️⃣  View detailed results with validation

---

🪣 S3 Bucket Takeover Detection

The extension automatically detects:

• ❌ Non-existent S3 buckets (takeover possible)
• ⚠️ Misconfigured bucket permissions
• 🔓 Publicly accessible buckets
• 📝 Bucket names in JS code

// These patterns are detected:
"https://bucket-name.s3.amazonaws.com"
"s3://bucket-name/path"
"bucket-name.s3.region.amazonaws.com"

---

🔧 Configuration

Discord Webhook

Get instant alerts when secrets are found:

1. Create a webhook in your Discord server
2. Go to extension Settings
3. Paste webhook URL
4. Enable Discord notifications

Custom Patterns

Add your own regex patterns for specific targets:

// Example: Custom API key pattern
{
  "name": "Custom API Key",
  "regex": "CUSTOM_[A-Za-z0-9]{32}",
  "severity": "high"
}

---

📊 Dashboard Features

📈	Real-time Stats - Tokens found, files scanned, pages analyzed
📋	Findings List - All detected secrets with source URLs
✅	Validation Status - Check if tokens are still active
📤	Export - Copy findings or export to JSON
🕐	History - Track all findings across sessions

---

🛡️ Security & Ethics

✅ Legitimate Use Cases

• 🎯 Bug bounty hunting
• 🔒 Security assessments
• 🏢 Authorized pentesting
• 📚 Security research
• 🎓 Educational purposes

❌ Do Not

• ⛔ Access systems without authorization
• ⛔ Use found credentials maliciously
• ⛔ Exploit vulnerabilities without permission
• ⛔ Share sensitive findings publicly

---

📁 Project Structure

Hardcoded-Token-Hunter/
├── manifest.json              # Extension config (Manifest V3)
├── background.js              # Service worker
├── content.js                 # Main content script
├── validator.js               # Token validation logic
├── deep-crawler.js            # JS file crawler
├── bucket-takeover-detector.js # S3 bucket scanner
├── token-scanner-worker.js    # Web worker for scanning
├── popup.html/js              # Extension popup
├── settings.html/js           # Settings page
├── history.html/js            # History dashboard
├── popup.css                  # Styles
└── icons/                     # Extension icons
    ├── icon16.png
    ├── icon48.png
    └── icon128.png

---

🎯 Example Findings

🔐 AWS Access Key Found!
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Key: AKIA52XXXXXXXXXXXXXX
Source: https://target.com/app.bundle.js
Line: 1842
Status: ⚠️ Potentially Active

🪣 S3 Bucket Takeover Possible!
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Bucket: company-assets-backup
Status: ❌ Does not exist
Risk: 🔴 Critical - Takeover possible!

---

🐛 Troubleshooting

Issue	Solution
No findings	Try Manual/Deep Scan mode
Extension not working	Check if Manifest V3 is supported
Discord not receiving	Verify webhook URL is correct
High false positives	Adjust sensitivity in settings

---

📚 References

• OWASP - Sensitive Data Exposure
• AWS Security Best Practices
• GitHub Secret Scanning Patterns

---

🙏 Credits

Developed by OFJAAAH

---

⚠️ For authorized security testing only. Use responsibly!