keyhunter.py

#!/bin/bash/python

import sys
import re
import requests
from bs4 import BeautifulSoup   # <-- ADIÇÃO AQUI

# Banner ASCII
banner = r"""
############################################################
# _  _________   __    _   _ _   _ _   _ _____ _____ ____  # 
#| |/ / ____\ \ / /   | | | | | | | \ | |_   _| ____|  _ \ #
#| ' /|  _|  \ V /____| |_| | | | |  \| | | | |  _| | |_) |#
#| . \| |___  | |_____|  _  | |_| | |\  | | | | |___|  _ < #
#|_|\_\_____| |_|     |_| |_|\___/|_| \_| |_| |_____|_| \_\#
#Hunt. Seek. Find           |             Code by nailtpax #
############################################################
"""

def main():

    if len(sys.argv) == 1:
       
        print(banner)
        print("Please provide a URL!\n")
        print("Usage: python3 keyhunter.py <url> [wordlist]\n")
        print("If no wordlist is provided, the default one will be used.")
        return 0

  
    print(banner)
    print("\n[+] Starting the hunt for keys and tokens...")

    wordlist = []
    keywords = [
        "api_key","apikey","_API_key","token","access_token","auth_token","client_secret",
"clientid","client_id","secret","authorization","x-api-key","x_api_key","x_api_key_id",
"bearer","password","passwd","pwd","passphrase","private_key","privkey","ssh_key",
"rsa_key","dsa_key","secret_key","app_key","appkey","application_key","consumer_key",
"consumer_secret","jwt","jwt_secret","jwt_token","oauth_token","oauth_secret",
"session_token","sessionid","session_id","cookie","auth","credentials","encryption_key",
"enckey","signing_key","s3_key","s3_secret","db_password","database_password",
"database_url","DATABASE_URL","connection_string","CONNECTION_STRING","token_key",
"refresh_token","refreshToken","accesskey","access_key_id","access_key","secret_access_key",
"vault_token","private_token","secret_token","private_api_key","api_secret_key",
"aws_access_key_id","aws_secret_access_key","aws_session_token","aws_token",
"AWS_SECRET","AWS_KEY","AKIA","ASIA","aws_credentials","gcp_api_key","gcp_client_email",
"gcp_private_key","gcp_project_id","google_api_key","google_client_email","google_private_key",
"azure_client_id","azure_client_secret","azure_tenant_id","azure_subscription_id",
"azure_storage_key","azure_sas","SharedAccessSignature","sas_token","sv","sig",
"heroku_api_key","heroku_key","heroku_token","slack_token","slack_signing_secret",
"slack_webhook","discord_token","discord_webhook","telegram_token","telegram_bot_token",
"_token","_clientToken","clientToken","--aws-key","stripe_key","stripe_secret","sk_test_",
"sk_live_","pk_test_","pk_live_","stripe_publishable_key","stripe_secret_key",
"stripe_api_key","paypal_client_id","paypal_secret","paypal_token","sendgrid_api_key",
"sg_api_key","SG.","mailgun_api_key","mailgun_key","postmark_server_api_token",
"twilio_account_sid","twilio_auth_token","twilio_api_key","twilio_secret",
"mapbox_key","mapbox_access_token","algolia_api_key","algolia_app_id","algolia_admin_key",
"mixpanel_token","mixpanel_key","sentry_dsn","sentry_key","newrelic_api_key","newrelic_key",
"datadog_api_key","datadog_app_key","datadog_api_token","pagerduty_integration_key",
"pagerduty_api_key","bugsnag_api_key","instana_api_token","segment_write_key",
"firebase_api_key","firebase_config","firebase_private_key","firebase_project_id",
"fcm_server_key","one_signal_app_id","one_signal_api_key","rocketchat_token",
"zendesk_api_token","zendesk_subdomain","zendesk_password","cloudinary_api_key",
"cloudinary_secret","mercadopago_access_token","mercadopago_client_secret",
"venmo_access_token","square_access_token","square_application_id","braintree_token",
"braintree_private_key","braintree_public_key","oauth_consumer_key","oauth_consumer_secret",
"oauth_client_id","oauth_client_secret","authorization_token","auth_token_header",
"X-Auth-Token","X-ACCESS-TOKEN","X-API-TOKEN","X-API-KEY","X-CSRF-Token","csrf_token",
"csrfmiddlewaretoken","_csrf","csrfToken","anti_csrf_token","cookie_secret","cookie_key",
"SECRET_KEY","SECRET_KEY_BASE","secret_key_base","FLASK_SECRET","DJANGO_SECRET_KEY",
"APP_SECRET","APP_SECRET_KEY","MASTER_KEY","MASTER_SECRET","ENCRYPTION_KEY",
"API_TOKEN","API_SECRET","API_KEY","SERVICE_TOKEN","SERVICE_KEY","SERVICE_SECRET",
"SERVICE_ACCOUNT_KEY","SERVICE_ACCOUNT_JSON","GOOGLE_APPLICATION_CREDENTIALS",
"GCP_CREDENTIALS","GCLOUD_KEY","GCLOUD_CREDENTIALS","KUBE_TOKEN","KUBERNETES_TOKEN",
"KUBE_CONFIG","DOCKER_HUB_USERNAME","DOCKER_HUB_PASSWORD","DOCKER_PASSWORD",
"NPM_TOKEN","NPM_AUTH_TOKEN","GITLAB_TOKEN","GITLAB_PRIVATE_TOKEN","GITHUB_TOKEN",
"GH_TOKEN","github_token","git_token","bitbucket_token","bitbucket_password",
"CI_JOB_TOKEN","CI_TOKEN","TRAVIS_API_KEY","TRAVIS_TOKEN","CIRCLECI_TOKEN","NETLIFY_AUTH_TOKEN",
"VERCEL_TOKEN","VERCEL_ENV_TOKEN","HEROKU_API_KEY","APPVEYOR_API_TOKEN","JENKINS_API_TOKEN",
"TOKEN_SECRET","token_secret_key","KEY","KEY_ID","KEY_SECRET","KEYPAIR","PGPASSWORD",
"PGUSER","POSTGRES_PASSWORD","POSTGRES_USER","MYSQL_PASSWORD","MYSQL_USER",
"MONGO_URI","MONGODB_URL","MONGODB_URI","REDIS_URL","REDIS_PASSWORD","REDIS_HOST",
"SMTP_PASSWORD","SMTP_USER","MAIL_PASSWORD","MAIL_USERNAME","MAILER_PASSWORD",
"EMAIL_PASSWORD","IMAP_PASSWORD","POP3_PASSWORD","FTP_PASSWORD","SFTP_KEY",
"SSH_PRIVATE_KEY","ssh-rsa","-----BEGIN RSA PRIVATE KEY-----","-----BEGIN PRIVATE KEY-----",
"-----BEGIN OPENSSH PRIVATE KEY-----","pem_key","pem_private_key","p12_certificate",
"pkcs12","keystore_password","keystore","cert_password","ssl_key","ssl_cert",
"TLS_KEY","TLS_CERT","PRIVATE_PEM","PFX_PASSWORD","PGP_PRIVATE_KEY","gpg_private_key",
"PGP_KEY","ENCRYPTION_PASSPHRASE","ENCKEY","SIGNING_KEY","SIGNING_SECRET",
"HMAC_KEY","HMAC_SECRET","HMAC_TOKEN","WEBHOOK_SECRET","WEBHOOK_TOKEN","webhook_key",
"oauth2_token","oidc_client_secret","oidc_client_id","okta_token","okta_client_secret",
"okta_client_id","ssh_passphrase","rsa_passphrase","rsa_private","dsa_private",
"consumerKey","consumerSecret","appSecret","appSecretKey","client_secret_key",
"paypal_secret_key","paypal_api_secret","amazon_pay_key","amazon_secret",
"aws_mfa_token","aws_profile","aws_role","aws_iam_role","iam_access_key",
"SERVICE_PRINCIPAL_SECRET","AZURE_CLIENT_SECRET","AZURE_AD_CLIENT_SECRET",
"AZURE_AD_TENANT","AZURE_AD_USERNAME","MS_GRAPH_TOKEN","MS_GRAPH_KEY",
"MICROSOFT_APP_ID","MICROSOFT_APP_PASSWORD","OKTA_CLIENT_SECRET","SHARED_SECRET",
"JWT_SECRET_KEY","JWT_PRIVATE_KEY","JWT_PUBLIC_KEY","JWT_ALGORITHM",
"SESSION_SECRET","SESSION_SECRET_KEY","COOKIE_SECRET_KEY","TOKEN_SECRET_KEY",
"AUTH0_CLIENT_ID","AUTH0_CLIENT_SECRET","AUTH0_DOMAIN","AUTH0_AUDIENCE",
"PASSWORD_SALT","PASSWORD_HASH","BCRYPT_SALT","BCRYPT_ROUNDS","PBKDF2_SALT",
"API_PASSWORD","INTERNAL_API_KEY","INTERNAL_TOKEN","SERVICE_ACCOUNT_KEYFILE",
"GOOGLE_OAUTH_CLIENT_ID","GOOGLE_OAUTH_CLIENT_SECRET","FACEBOOK_APP_SECRET",
"FACEBOOK_APP_ID","TWITTER_API_KEY","TWITTER_API_SECRET","TWITTER_ACCESS_TOKEN",
"TWITTER_ACCESS_SECRET","INSTAGRAM_CLIENT_SECRET","INSTAGRAM_ACCESS_TOKEN",
"LINKEDIN_CLIENT_SECRET","LINKEDIN_ACCESS_TOKEN","etsy_api_key","woocommerce_consumer_key",
"woocommerce_consumer_secret","wordpress_api_key","wp_api_key","wp_secret_key",
"config_api_key","config_key","config_secret","env_api_key",".env","env_content",
"ENV_FILE","ENVIRONMENT_FILE","credentials.json","credentials.yml","credentials.yaml",
"secrets.yml","secrets.yaml","secrets.json","secrets.properties","appsettings.json",
"appsettings.Production.json","web.config","parameters.yml","parameters.php",
"config.php","config.js","config.json","config.yml","settings.py","settings.json",
"local_settings.py","production_settings.py","database.yml","database.json",
"secrets.php","wp-config.php","credentials.php","id_rsa","id_dsa","authorized_keys",
"auth.json","auth.yml","auth.php","auth_token_header","auth_header","authorization_header",
"ACCESS_TOKEN_SECRET","REFRESH_TOKEN_SECRET","ACCESS_KEY_SECRET","SESSION_KEY",
"INTEGRATION_KEY","INTEGRATION_SECRET","SERVICE_TOKEN_KEY","API_CLIENT_SECRET",
"API_CLIENT_ID","APPCLIENTID","APPCLIENTSECRET","APP_ID","APP_SECRET","APP_TOKEN",
"REMOTE_KEY","REMOTE_SECRET","REMOTE_TOKEN","PUSHER_APP_KEY","PUSHER_APP_SECRET",
"PUBNUB_SUB_KEY","PUBNUB_PUB_KEY","TWILIO_SID","TWILIO_TOKEN","TWILIO_AUTH",
"ONE_SIGNAL_API_KEY","ONESIGNAL_REST_API_KEY","ONESIGNAL_API_KEY",
"stripe_client_id","stripe_client_secret","SQUARE_ACCESS_TOKEN","SENTRY_RELEASE",
"HIPCHAT_TOKEN","SLACK_APP_TOKEN","MATTERMOST_TOKEN","ROLLBAR_ACCESS_TOKEN",
"ROLLBAR_POST_SERVER_ITEM_ACCESS_TOKEN","BUGSNAG_KEY","BUGSNAG_TOKEN",
"LICENCE_KEY","LICENSE_KEY","LICENSE_SECRET","SERIAL_KEY","REGISTRATION_KEY",
"DRUPAL_HASH_SALT","MAGENTO_SECRET_KEY","SHOPIFY_API_KEY","SHOPIFY_ACCESS_TOKEN",
"SHOPIFY_SHARED_SECRET","KUBERNETES_SERVICE_ACCOUNT_TOKEN","SERVICE_ACCOUNT_TOKEN",
"OCI_API_KEY","ORACLE_CLOUD_API_KEY","ALIBABA_CLOUD_ACCESS_KEY","ALIBABA_CLOUD_SECRET",
"AZURE_STORAGE_ACCOUNT_KEY","AZURE_STORAGE_CONNECTION_STRING","AZURE_STORAGE_SAS_TOKEN",
"AZURE_SAS_TOKEN","GITHUB_APP_PRIVATE_KEY","GITHUB_APP_ID","GITHUB_APP_INSTALLATION_ID",
"GH_APP_KEY","GITHUB_OAUTH_TOKEN","GH_APP_SECRET","GITHUB_CLIENT_SECRET","GITHUB_CLIENT_ID",
"BITBUCKET_APP_PASSWORD","BITBUCKET_USERNAME","BITBUCKET_PASSWORD","ARTIFACTORY_API_KEY",
"JFROG_API_KEY","NEXUS_API_KEY","CONAN_AUTH_TOKEN","S3_SECRET_KEY","S3_SECRET",
"S3_ACCESS_KEY","S3_BUCKET_KEY","CLOUDFLARE_API_TOKEN","CF_API_TOKEN","CF_AUTH_EMAIL",
"CF_AUTH_KEY","CLOUDFLARE_ZONE_ID","FASTLY_API_KEY","FASTLY_SERVICE_ID",
"FASTLY_TOKEN","AKAMAI_CLIENT_TOKEN","AKAMAI_CLIENT_SECRET","AKAMAI_ACCESS_TOKEN",
"MAILCHIMP_API_KEY","MAILCHIMP_USERNAME","MAILCHIMP_SECRET","ZOHO_AUTH_TOKEN",
"ZOHO_CLIENT_SECRET","ZOHO_CLIENT_ID","APIGEE_API_KEY","APIGEE_CLIENT_ID",
"APIGEE_CLIENT_SECRET","SAML_METADATA","SAML_CERT","SAML_PRIVATE_KEY","SAML_SP_ENTITY_ID",
"PRIVATE_TOKEN","PERSONAL_ACCESS_TOKEN","PAT","PERSONAL_TOKEN","personal_token",
"PAT_TOKEN","oauth_token_secret","oauth_token_key","token_id","token_secret_id",
"device_token","mobile_token","firebase_token","fcm_token","push_token","expo_token",
"crendentials","credencials","credential","cred","secrets","secret_token_id",
"secret_key_id","secretid","secretId","api_secret_id","api_secret_token",
"api_key_id","api_id","key_id","clientid_secret","app_secret_key","app_secret_token",
"app_secret_base","keypair_id","key_pair_id","cloud_key","cloud_secret","cloud_token",
"tokenization_key","encryption_token","kms_key","kms_key_id","kms_keyring","kms_arn",
"gpg_passphrase","ssh_key_passphrase","ssh-key","ssh_key_id","ssh_key_secret","ssh_key_name",
"ssl_certificate","ssl_certificate_key","tls_secret","tls_key_password","keystore_pw",
"cert_key","cert_secret","cert_token","keystore_alias","keystore_key","auth0_token"
    ]
    if len(sys.argv) > 2:
        try:
            with open(sys.argv[2], 'r') as f:
                wordlist = [line.strip() for line in f if line.strip()]
        except FileNotFoundError:
            print(f"Wordlist '{sys.argv[2]}' not found. Using default wordlist.")
            wordlist = keywords
    else:
        print("Using default wordlist.")
        wordlist = keywords

    site = sys.argv[1].strip()

    patterns = {
    # Cloud / Provider keys
    "AWS Access Key ID": r"AKIA[0-9A-Z]{16}",
    "AWS Secret Access Key (heuristic, base64-like 40 chars)": r"(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])",
    "AWS Session Token (long base64-like)": r"(?<!\S)(?:IQoJ|AQoA)[A-Za-z0-9/+=]{100,}(?!\S)",
    "GCP API Key (Google API key)": r"AIza[0-9A-Za-z\-_]{35}",
    "GCP Service Account JSON (private_key field)": r"\"private_key\"\s*:\s*\"-----BEGIN [A-Z ]+PRIVATE KEY-----",
    "Azure Client Secret / SAS token (heuristic)": r"(?:azure_client_secret|azure_sas|sig|sv|se)[:=]\s*['\"]?[A-Za-z0-9\-._~+/=]{16,}['\"]?",
    # Payment / common provider tokens
    "Stripe Keys (sk_/pk_)": r"(?:sk_live|sk_test|pk_live|pk_test)_[A-Za-z0-9]{24,}",
    "SendGrid SG. token": r"SG\.[A-Za-z0-9\-_]{20,}",
    "PayPal / Braintree / Square (generic)": r"(?:paypal|braintree|square)_[A-Za-z0-9\-_]{8,}",
    # Authorization / Bearer / JWT
    "Bearer Authorization header": r"Bearer\s+[A-Za-z0-9\-\._~\+/=]+",
    "JWT (compact serialization)": r"eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+",
    # Generic tokens / secrets heuristics
    "Generic long base64-like secret (>=40 chars)": r"[A-Za-z0-9+/]{40,}={0,2}",
    "Generic long hex token (>=32 hex chars)": r"\b[0-9a-fA-F]{32,}\b",
    "Generic token (alnum >= 32)": r"[A-Za-z0-9\-_]{32,}",
    # PEM / SSH private keys
    "PEM Private Key (block)": r"(?s)-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----.+?-----END (?:RSA |OPENSSH |EC )?PRIVATE KEY-----",
    "OpenSSH one-line public key (ssh-rsa etc.)": r"ssh-(?:rsa|ed25519|dss) [A-Za-z0-9+/=]{100,}",
    "Private key file indicators (id_rsa etc.)": r"\b(id_rsa|id_dsa|private_key.pem|private-key\.pem|ssh_private_key)\b",
    # Connection strings
    "MongoDB / SQL connection strings": r"(?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|mariadb|sqlserver)://[^\s'\"<>]+",
    "Generic connection string / JDBC": r"(?:jdbc:[a-z]+://)[^\s'\"<>]+",
    # HTTP headers / CSRF / cookies
    "Authorization header (generic)": r"Authorization\s*[:=]\s*['\"]?([A-Za-z0-9\-\._~\+/=]+)['\"]?",
    "CSRF tokens / csrfmiddlewaretoken": r"(?i)(?:csrfmiddlewaretoken|_csrf|csrf_token|csrfToken)[:=]\s*['\"]?([A-Za-z0-9\-_]{8,})['\"]?",
    "Cookie / session id": r"(?:sessionid|session_id|sess|sid|cookie)[:=]\s*['\"]?[A-Za-z0-9\-_]{8,}['\"]?",
    # VCS / CI / Dev platform tokens
    "GitHub PAT (ghp_/gha_/gho_/ghu_/ghs_/ghr_)": r"gh[pousr]_[A-Za-z0-9_]{36,}",
    "GitLab personal token (glpat-)": r"glpat-[A-Za-z0-9_-]{20,}",
    "Generic CI token / env tokens (NPM, GITLAB, CIRCLECI, TRAVIS)": r"\b(?:NPM_TOKEN|GITLAB_TOKEN|CI_JOB_TOKEN|CIRCLECI_TOKEN|TRAVIS_TOKEN|VERCEL_TOKEN|NETLIFY_AUTH_TOKEN)\b",
    # Messaging / other services
    "Slack tokens (xox-..)": r"xox[baprs]-[A-Za-z0-9-]+",
    "Twilio API Key (SK...)": r"\bSK[0-9a-fA-F]{32}\b",
    "Firebase server key / FCM": r"AAAA[A-Za-z0-9\-_]{7,}",
    # File / env patterns
    ".env assignment (KEY=VALUE)": r"(?m)^[A-Z0-9_]+=(.+)$",
    "Credentials filename indicators": r"\b(?:credentials\.json|serviceAccount\.json|google-services\.json|.env|secrets\.yml|keystore\.jks|.pem|.p12|.pfx)\b",
    # Heuristics / misc
    "Potential webhook / webhook secret": r"(?:webhook|webhook_secret|webhook_token)[:=]\s*['\"]?[A-Za-z0-9\-_]{8,}['\"]?",
    "HMAC / Signing key": r"(?:HMAC|SIGNING|SIGNATURE)[_\- ]?(?:KEY|SECRET)[:=]\s*['\"]?[A-Za-z0-9\-_+/=]{8,}['\"]?",
    "KMS / ARN like (heuristic)": r"arn:aws:kms:[a-z0-9-]+:\d{12}:key\/[A-Za-z0-9-]+",
}

    def search_keywords(content, source="HTML"):
        found = False

        
        for word in keywords:
            matches = re.findall(rf"{word}['\"]?\s*[:=]\s*['\"]?([\w-]+)", content, re.IGNORECASE)
            if matches:
                found = True
                print(f"\n[+] Possible '{word}' found in {source}:")
                for m in matches:
                    print(f"    {m}")

        
        soup = BeautifulSoup(content, "html.parser")
        for meta in soup.find_all("meta"):
            name = meta.get("name")
            content_val = meta.get("content")
            if name and content_val and name.lower() in [k.lower() for k in keywords]:
                found = True
                print(f"\n[+] Possible '{name}' found in META tag:")
                print(f"    {content_val}")

        return found

    try:
        r = requests.get(site)
        r.raise_for_status()
    except Exception as e:
        print(f"Error accessing the website: {e}")
        exit()

    html_content = r.text
    search_keywords(html_content, "HTML")

if __name__ == "__main__":
    main()