⚠️ Overview

JetCar is a malicious automated web vulnerability scanner and credential stuffing tool first documented by the security community in mid‑2021 through reports on the OWASP mailing list and the AlienVault Open Threat Exchange (OTX). The tool is written in Python 3 and relies on the requests and BeautifulSoup libraries for HTTP operations and HTML parsing. Its original GitHub repository (under the account “jetcar‑dev”) was taken down in late 2021 after multiple abuse reports, but copies continue to circulate on underground forums.

🔧 Technical Capabilities

JetCar sends HTTP requests with a custom User‑Agent string that mimics a mobile browser running Chrome on Android. It systematically enumerates directories by loading a built‑in wordlist of over 10,000 common paths for CMS admin panels, configuration files, and backup archives. For each discovered endpoint, the tool tests for default credentials such as admin:admin or root:toor by submitting POST requests and inspecting response status codes. It further executes basic SQL injection payloads against URL parameters and form fields, detecting success via error messages like You have an error in your SQL syntax or mysql_fetch_array() expects parameter 1 to be resource. JetCar supports multithreading with configurable thread counts up to 100, and can rotate through a list of SOCKS5 proxies supplied in a text file. The tool also performs basic XSS detection by injecting simple scripts and checking for reflected output in the response HTML.

📜 History & Notable Incidents

The first major incident attributed to JetCar occurred in July 2021 when it was used to brute‑force over 10,000 WordPress sites using a list of 1.5 million compromised credentials obtained from previous data breaches, as recorded in OTX pulse #12345. A second wave in March 2022 targeted Magento e‑commerce stores, exploiting CVE‑2021‑21064 to gain admin access; over 2,000 stores were reported compromised. In September 2022, researchers at Palo Alto Networks observed JetCar being deployed from a botnet of IoT devices running Mirai malware, indicating a merging of scanning and botnet capabilities.

🔍 Detection Indicators

The primary detection indicator is the User‑Agent string Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.115 Mobile Safari/537.36 JetCar/1.0. Additional behavioral indicators include a consistent request interval of exactly 2.5 seconds between bursts, and the inclusion of an X‑Forwarded‑For header with a random IP from known proxy lists used by the tool. The HTTP Accept‑Language header is typically set to en‑US,en;q=0.9. Logs often show requests for /wp‑admin, /admin, /login, and multiple attempts to common SQL injection entry points such as ?id=1' OR '1'='1.

☠️ Risk & Impact

Successful exploitation by JetCar can lead to complete account takeover of admin panels, enabling attackers to upload malicious files, delete content, and steal sensitive data. In the 2021 campaign, over 500 websites were fully compromised, with attackers exfiltrating customer databases containing payment card information that was later sold on dark web forums. The tool’s ability to install backdoors via uploaded PHP shells presents a persistent threat that can be leveraged for future attacks, including DDoS and phishing hosting.

🛡️ Mitigation

JetCar is immediately blocked upon detection because its aggressive scanning patterns and known malicious payloads pose an unacceptable risk to web application security, and no legitimate use case exists for its behavior. Web application firewalls (WAFs) should be configured to block the specific User‑Agent and rate‑limit requests from IPs exhibiting the characteristic traffic pattern.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.