KeyHunter

Check for leaked API keys and secrets any website's JavaScript.

KeyHunter running on sites of the last 7 YCombinator batches

Installation

You can install KeyHunter as a Crate from crates.io:

cargo install keyhunter

You can also use it as a library:

[dependencies]
# 'build-binary' feature is on by default, which isn't useful for library use
keyhunter = { version = "0.2.0", default-features = false }

Library docs are available on docs.rs.

Usage

To reproduce the example above, run make yc

Provide KeyHunter with a URL to start scanning from. It will visit all pages on the same domain that URL links to, find all scripts referenced by those pages, and check them for leaked API keys and secrets.

keyhunter https://example.com

Authentication

You can include one or more headers in all requests KeyHunter makes with the --header (or -H) flag. This means you can include an Authorization header to scan websites that require authentication.

keyhunter https://example.com -H "Authorization: Bearer <token>"

# Multiple headers
keyhunter https://example.com -H "Cookie: session-cookie=123" -H "x-another-header: foo"

This flag follows the same conventions as curl's -H flag.

For more information and a list of all available arguments, run keyhunter --help.

Output Format

Using the --format <format> flag, you can specify how KeyHunter should output its findings.

• default: Pretty-printed, human readable output. This is the default format.
• json: Print a JSON object for each finding on a separate line. This format is really JSON lines.

Disclaimer

This tool is for educational purposes only. Only use it on websites and/or web applications that you own or that are owned by an organization that has given you their explicit consent. Do not use this tool for malicious purposes. Please read the LICENSE for more information.