Keyring
Keyring is a tool to search a given URL for API Keys and other secrets.
Current Keys:
- Shodan (Very High Confidence, checks validity and available credits with the shodan library)
- Github API (High confidence, static characters and unique substring)
- Slack (High Confidence, static characters)
- Slack Bot (High Confidence, static characters)
- Slack Webhook Links (High Confidence, static characters and unique substring)
- Google API (High Confidence, static characters)
- Google Access Tokens (High Confidence, static characters)
- Google OAUTH Secrets (High Confidence, unique substring)
- AWS Access Tokens (High Confidence, static characters)
- Discord Bot Tokens (High Confidence, static characters and substring sizes)
- Discord Webhook Links: (High Confidence, static characters and substring types)
- Discord Nitro Links (High Confidence, static characters and substring sizes)
- Redis URLs (High Confidence, static characters and unique substring)
- SSH Keys (High Confidence, static characters)
- Heroku API Keys (High Confidence, static characters and unique substring)
- Twilio API Keys (Medium Confidence, few static characters but static string size)
- Facebook OAUTH (High Confidence, static characters and unique substring)
- Non-specific API Keys (Medium Confidence, static format may exclude potential keys)
Severity Rating (1-10):
- Access Tokens (10: can result in direct compromise of related systems)
- Redis URLs (10: can lead to potentially severe leaks)
- SSH Keys (9: can potentially lead to system access in systems with poorly configured access control)
- OAUTH Secrets (7: can disclose sensitive information or lead to credential theft)
- Bot Tokens and Webhooks (6: can result in sensitive information being viewed, members being banned/kicked/etc.)
- API Keys (5: can result in either loss of credits or sensitive information being viewed)
- Nitro Links (2 or 0: If not intended for giveaway, can result in neglibigle financial loss.)
TODO:
- Add more keys (please send me either a sample key or regex for anything you want added)
- Bug fixes