streaak/keyhacks
Keyhacks
Keyhacks is a command-line tool that tests whether API keys and tokens for dozens of cloud services are valid and active. It automates the verification of discovered credentials during security auditing and penetration testing, confirming if leaked or harvested API keys, tokens, and secrets are still operational.
The tool validates credentials by sending lightweight, service-specific HTTP requests to each platform's API endpoint and inspecting the response status or body. Each validation runs independently without storing state between requests, using pre-defined request templates with the correct URL, HTTP method, and headers for that service. The tool routes each credential to its corresponding validation logic based on a service identifier or key format.
Keyhacks covers credential validation for a wide range of SaaS platforms including AWS, Azure, Google Cloud, GitHub, Slack, Stripe, Twilio, and many others. It also supports enumerating IAM permissions for discovered AWS credentials and testing for stored cross-site scripting via Algolia API keys. The tool validates credentials through service-specific endpoints and CLI tools, such as using the AWS CLI to call STS GetCallerIdentity or the gcloud CLI to activate Google Cloud service accounts.
Features
- Key Validators - A command-line tool that tests whether API keys and tokens for dozens of cloud services are valid and active.
- API Credential Validations - Validates Zendesk API keys by making requests to the Support admin interface.
- Token Validations - Validates Travis CI API tokens by listing repositories via the API.
- Endpoint Validation - Validates API keys by sending a single HTTP request to a service-specific endpoint and checking the response.
- Slack Token Validators - Verifies Slack API tokens by calling the auth.test endpoint and inspecting the response to confirm they are active.
- Google Service Account Validators - Activates a Google service account JSON key using gcloud and prints an access token to confirm validity.
- Credential Enumeration - Enumerates valid credentials from a set of leaked or harvested API keys, tokens, and secrets across many services.
- Slack Integrations - Tests Slack webhook URLs by sending empty payloads and checking for expected error messages.
- Token Validations - Verifies Slack API tokens are active by sending authentication test requests.
- Webhook Validations - Confirms Slack webhook URLs are functional by sending test payloads and inspecting responses.
- Token Validations - Validates Telegram bot tokens by querying the getMe endpoint of the Bot API.
- API Key Authentication - Validates Keen.io API keys by listing collections, confirming the key is active and has read access.
- API Credential Validations - Validates WakaTime API keys by retrieving the current user via the API.
- API Key Management - Validates Mapbox access tokens by performing geocoding requests or querying token info endpoints.
- API Key Auditing - Confirms Lokalise API tokens are valid by listing projects through the Lokalise API.
- API Credential Validations - Validates YouTube API keys by fetching content details for a channel.
- Key Validators - Provides automated validation of API keys across dozens of cloud services to confirm they are still active.
- Credential Validators - Tests AWS access keys with the CLI and enumerates IAM permissions for discovered credentials.
- Service-Specific Token Validations - Validates Twitter bearer tokens by fetching subscription counts from the Account Activity API.
- Client Credentials - Tests a GitHub client ID and client secret by making an authenticated API request.
- Credential Format Validation - Routes each credential to its corresponding validation logic based on key format or service identifier.
- API Credential Validations - Validates Square credentials by sending requests with app IDs, client secrets, or auth tokens.
- Integration Key Validators - Validates Pendo integration keys by fetching feature or metadata schema through the Pendo API.
- API Credential Validations - Validates Twitter API secrets by requesting OAuth2 bearer tokens.
- OAuth Client Secret Validators - Requests an OAuth token from DeviantArt using a client ID and secret to confirm the secret is valid.
- API Credential Validations - Validates Twilio credentials by listing accounts via the REST API.
- Cloud Credential Validators - Exchanges Azure client IDs and secrets for access tokens to confirm the credentials are valid.
- Google - Uses the gcloud tool to test Google Cloud service account credentials from a JSON file.
- OAuth Credential Validators - Exchanges PayPal client IDs and secrets for access tokens to confirm the credentials are valid.
- API Token Validators - Verifies PagerDuty API tokens by listing schedules through the PagerDuty API.
- Bearer Token Validators - Validates SendGrid bearer tokens by listing available scopes through the SendGrid API.
- OAuth Token Validators - Verifies LinkedIn OAuth tokens by requesting an access token and checking the API response for validity.
- Registry Token Validators - Validates npm tokens by querying the npm API and returning the associated username if the token is active.
- SAS Token Validators - Validates Microsoft SAS tokens by accessing Azure Blob storage and retrieving service properties.
- Service-Specific Token Validations - Validates Sonarcloud tokens by querying the authentication validation endpoint.
- HTTP Request Templates - Each validation uses a pre-defined request template with the correct URL, HTTP method, and headers for that service.
- Webhook URL Validators - Tests Microsoft Teams webhook URLs by sending empty payloads and checking for expected error messages.
- Access Token Validators - Validates Salesforce access tokens by querying the Salesforce REST API to confirm they are active.
- Response Body Parsing - Extracts validation results by parsing the JSON or text response body for expected fields or error messages.
- Google Maps - Tests the key against multiple Google Maps API endpoints like Static Maps, Geocoding, or Directions to confirm it is active.
- New Relic - Queries the NerdGraph API with the personal API key to retrieve the user's context and verify the key is active.
- New Relic REST - Lists applications from the New Relic REST API using the API key to confirm it is valid.
- Recaptcha - Sends a POST request to the siteverify endpoint with the secret key and a test response to confirm the key is valid.
- Permission Enumerators - Runs the enumerate-iam tool with discovered AWS credentials to list all permitted actions.
- Azure Client Credential Validators - Requests an OAuth2 token from the Microsoft identity platform using the client ID, secret, and tenant ID to verify they are valid.
- Credential Validators - Uses the gcloud CLI to activate the service account from a JSON key file and prints an access token to verify it is valid.
- Square Credential Validators - Revokes a random access token with the Square app ID and client secret to test their validity.
- Security Operations Automation - Automates the verification of exposed credentials during penetration testing or incident response.
- Square Auth Token Validators - Lists locations from the Square API using the auth token to confirm it is active.
- Grafana Token Validators - Tests a Grafana API token using Bearer or Basic authorization to confirm it is valid.
- Stateless Execution - Each validation runs independently without storing state or session data between requests.
- HTTP Status Code Management - Determines key validity by inspecting the HTTP status code returned from the API endpoint.
- Mapbox - Geocodes a location or checks token validity via the Mapbox API to confirm the token is active.
- Salesforce - Fetches API metadata from a Salesforce instance using the bearer token to verify it is valid.
- Twilio Credential Validators - Lists Twilio accounts via the REST API using the account SID and auth token to confirm they are valid.
- API Key Discovery - Quick methods to validate API keys discovered in bug bounties.
- Cloud Security Auditing - Validates API keys found during bug bounty engagements.
- Secret Scanning - Validates API keys found during security assessments.
- Security References - Methods to check leaked API keys from bug bounties.
