keyFinder is a passive browser extension for Chrome and Firefox that scans every page you visit for leaked API keys, tokens, and credentials, aimed at authorized testers and defenders.
| Tool | momenbasel/keyFinder — passive API key and secret discovery browser extension for Chrome and Firefox |
| Category | Browser-based secret scanning / reconnaissance |
| Primary Use | Passively surfacing accidentally leaked API keys, tokens, and connection strings during authorized web app testing, bug bounty recon, and review of your own applications. |
| Safe Use | The README's disclaimer restricts use to security research and authorized testing — finding leaked secrets on your own applications or during authorized penetration tests; extracted secrets must never be used against systems you do not own. |
| Telemetry Note | Purely client-side and passive — it sends no traffic to targets, so it leaves virtually no server-side footprint; findings stay in local extension storage capped at 5000 entries, exportable only by the operator. |
Browser-based secret leakage remains one of the quietest failure modes in web applications, and momenbasel/keyFinder attacks the problem from an unusual angle: instead of a CI pipeline scanner or a Burp extension, it embeds detection directly into the browsing session. Once installed as a Chrome or Firefox extension, it silently inspects every page the operator visits, looking for AWS access keys, GitHub PATs, Stripe secrets, OpenAI keys, JWTs, private keys, and dozens of other credential formats. The project has accumulated 716 stars, is written in pure vanilla JavaScript with zero dependencies, and ships under an MIT license, which matters for a tool you are deliberately placing inside your browser's trust boundary.
The detection corpus is the first thing worth examining: over 80 regex patterns defined in js/patterns.js, organized across cloud, source control, payments, communication, AI/ML, database, SaaS, infrastructure, crypto, and generic categories. Cloud coverage includes AWS access keys, secret keys, session tokens and Cognito material, Google Cloud API keys and OAuth values, and Azure storage keys, SAS tokens, and connection strings. Source control patterns target GitHub classic and fine-grained PATs plus OAuth tokens, GitLab PATs, pipeline and runner tokens, and Bitbucket credentials. Payment detection spans the full Stripe family — secret, publishable, restricted, and webhook keys — alongside PayPal Braintree and Square.
Communication and SaaS providers get equally thorough treatment: Slack bot, user, app tokens and webhooks, Discord bot tokens, Telegram, Twilio, and SendGrid keys, plus Shopify, Sentry, New Relic, PlanetScale, Linear, Notion, Datadog, Algolia, and Mapbox credentials. The AI category reflects how recent this tool's pattern set is: OpenAI, Anthropic, HuggingFace, and Replicate tokens are all covered — credential classes that barely existed as scanning targets a few years ago. Database connection strings for MongoDB, PostgreSQL, MySQL, and Redis round out the structured patterns, and a generic tier catches JWTs, Bearer tokens, Basic Auth headers, credential-bearing URLs, and raw private key formats like RSA, EC, OpenSSH, PGP, and DSA.
What elevates keyFinder above a naive regex overlay is the breadth of attack surfaces it monitors — ten per page load, per the README. It checks src attributes on script tags for tokens in query parameters, scans inline <script> contents, fetches and scans same-origin external JavaScript files, inspects <meta> tags, hidden <input type="hidden"> fields, data-* attributes, and HTML comment nodes. Comments and hidden fields are classic repositories for secrets accidentally left behind by templating engines and debug builds, and checking them is a mark of practical field experience rather than a checkbox exercise.
The last three surfaces are where the architecture gets interesting. The extension analyzes href and URL parameters for tokens in query strings — a distressingly common pattern in analytics and marketing integrations — and scans localStorage and sessionStorage, where SPA frameworks frequently park bearer tokens and API keys with little thought to exposure. Most notably, it intercepts XHR and Fetch responses in the MAIN world through js/interceptor.js, catching secrets returned by API endpoints that never render visibly in the DOM. A Shannon entropy analysis layer flags high-entropy strings that may not match any documented provider format, giving it a safety net for novel or internal credential schemes.
The execution model follows modern Manifest V3 practice with a deliberate split. js/content.js runs in an ISOLATED world and performs the DOM, script, and network scanning, while js/interceptor-loader.js sets a per-page nonce and injects the MAIN-world interceptor that hooks XHR and Fetch and scans window globals. Communication between the two worlds travels over a CustomEvent channel hardened with that per-page nonce — a thoughtful detail, since cross-world message channels in extensions are a known injection vector. A background.js service worker handles storage and message routing, and the whole footprint is described as minimal on CPU and memory.
SPA awareness is handled through a MutationObserver that re-scans dynamically injected DOM, which means the tool keeps working on React and Vue applications that mutate long after the initial page load. Every frame counts — the extension scans iframes and embedded content too, not just the top-level document. Findings accumulate in bounded local storage with a 5000-finding FIFO cap and serialized writes across tabs, a design that prevents unbounded memory growth during long browsing sessions. Tabs with findings get a red-dot badge overlay on the extension icon, giving the operator a passive heads-up without interrupting the workflow.
The findings dashboard, results.html, is styled as a flat terminal-like ops console with severity-sorted output, click-to-filter severity tiles, a latest-finding ticker, and live search where / focuses and Esc clears the field. Triage is one-click: any match chip copies the secret to the clipboard, timestamps show relative age with absolute time on hover, and individual findings can be deleted. Export supports JSON and CSV, and the CSV path includes a formula-injection sanitiser — a small but telling detail, since exporting unsanitized findings into a spreadsheet is a real way to turn a recon tool into an accidental attack on yourself.
Custom keywords extend the scanner beyond the built-in patterns. The popup UI accepts up to 50 validated user-supplied terms, which are then matched against script URLs, inline code, and key-value assignments on every page visited. The defaults are sensible — key, api_key, apikey, api-key, secret, token, access_token, auth, credential, password, client_id, client_secret — and an operator testing a specific internal platform can add vendor-specific parameter names to tune detection. Installation is a one-liner from source (git clone https://github.com/momenbasel/keyFinder.git) followed by loading unpacked via chrome://extensions, or straight from the Chrome Web Store and Firefox Add-ons listings.
From a defensive perspective, keyFinder is as useful to blue teams as to bug bounty hunters. Running it against your own staging and production deployments turns an ordinary manual QA session into a continuous secret-leakage audit, catching the exact failure modes — secrets in bundled JavaScript, tokens in query strings, credentials in localStorage, leftovers in HTML comments — that automated CI scanners miss because they only see the source repository, not the rendered and running application. A defender who browses their own app with keyFinder active is effectively performing client-side DLP on their delivery pipeline's output.
The governance story is unusually complete for a tool of this size. The README carries an explicit disclaimer restricting use to security research and authorized testing — your own applications or penetration tests you are contracted to perform — and points to a SECURITY.md documenting the threat model, disclosure policy, and known limitations, plus a CHANGELOG.md for release history. It is maintained by GreyCore Labs, a US offensive security firm, with separate build packaging for Chrome and Firefox via scripts/build.sh. That institutional backing suggests the project is positioned for long-term maintenance rather than a one-off conference release.
For the authorized professional, keyFinder occupies a genuinely under-served niche: passive, always-on secret detection that rides along with normal browsing rather than demanding a dedicated scanning session. Nothing found by the tool should ever be exercised against systems you do not own — discovering a leaked credential is a finding to report, not a license to pivot. Used within that boundary, it is one of the more efficient ways to convert dead browsing time into continuous reconnaissance evidence, and its clean MV3 architecture, entropy fallback, and hardened inter-world bridge make it a codebase worth reading even if you never install it.
momenbasel/keyFinder.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.