From b73c2185b02cce665d04c20ef477e3f2b4db72ca Mon Sep 17 00:00:00 2001 From: moamen Date: Tue, 7 Apr 2026 18:22:42 +0200 Subject: [PATCH] v2.0.0: Complete rewrite - Manifest V3, enterprise-grade secret detection - Migrated to Chrome Manifest V3 with service worker architecture - 80+ secret detection patterns covering AWS, GCP, Azure, GitHub, GitLab, Stripe, Slack, Discord, OpenAI, and 30+ other providers - 10 scanning surfaces: inline scripts, external scripts, meta tags, hidden inputs, data attributes, HTML comments, URL params, web storage, cookies, and network response interception - Shannon entropy analysis for detecting undocumented secret formats - MAIN world interceptor for XHR/fetch response scanning and window globals - Professional dark-theme UI with filtering, search, and CSV/JSON export - Zero dependencies - removed jQuery, Bootstrap, font-awesome, popper - Proper XSS-safe DOM rendering throughout - Badge counter on extension icon showing finding count - All frames scanning including iframes --- .gitignore | 10 + README.md | 145 ++++++-- css/bootstrap.min.css | 7 - css/font-awesome.min.css | 4 - css/icon.png | Bin 5516 -> 0 bytes css/popup.css | 240 +++++++++++++ css/results.css | 341 +++++++++++++++++++ css/style.css | 106 ------ https---github.com-momenbasel-keyFinder.git | 1 - icons/icon128.png | Bin 0 -> 1602 bytes icons/icon16.png | Bin 0 -> 228 bytes icons/icon48.png | Bin 0 -> 612 bytes js/background.js | 109 +++++- js/bootstrap.min.js | 7 - js/content.js | 354 +++++++++++++++++--- js/download | 0 js/interceptor.js | 106 ++++++ js/jquery.js | 2 - js/patterns.js | 134 ++++++++ js/popper.min.js | 5 - js/popup.js | 114 ++++--- js/results.js | 304 +++++++++++++---- manifest.json | 43 ++- popup.html | 98 +++--- results.html | 121 +++---- 25 files changed, 1809 insertions(+), 442 deletions(-) create mode 100644 .gitignore delete mode 100644 css/bootstrap.min.css delete mode 100644 css/font-awesome.min.css delete mode 100644 css/icon.png create mode 100644 css/popup.css create mode 100644 css/results.css delete mode 100644 css/style.css delete mode 160000 https---github.com-momenbasel-keyFinder.git create mode 100644 icons/icon128.png create mode 100644 icons/icon16.png create mode 100644 icons/icon48.png delete mode 100644 js/bootstrap.min.js delete mode 100644 js/download create mode 100644 js/interceptor.js delete mode 100644 js/jquery.js create mode 100644 js/patterns.js delete mode 100644 js/popper.min.js diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..b50ae36 --- /dev/null +++ b/.gitignore @@ -0,0 +1,10 @@ +.DS_Store +*.crx +*.pem +*.zip +.idea/ +.vscode/ +*.swp +*.swo +*~ +.claude/ diff --git a/README.md b/README.md index d6ac3d7..684eafc 100644 --- a/README.md +++ b/README.md @@ -1,50 +1,141 @@

- logo of keyfinder -

-
- -

- - - - + KeyFinder logo

-# What is keyFinder? -keyFinder is chrome extension that searches the DOM for any embedded script link, as script tag may contain keys for specific API(such as Google maps API) and you can add keywords to search for it at any website you visit. +

KeyFinder

+

+ Passive API key and secret discovery for Chrome +

+

+ + + + + +

-## Features: -* it searches the DOM for "src" of scripts and see if it contains certain words such as "keys" and save them. -* it works at background -* it is expandable(as you can add words to it) +
+KeyFinder is a Chrome extension that passively scans every page you visit for leaked API keys, tokens, secrets, and credentials. It runs silently in the background with zero configuration required. +## What It Detects +KeyFinder ships with **80+ detection patterns** covering secrets from: +| Category | Providers | +|----------|-----------| +| **Cloud** | AWS (Access Keys, Secret Keys, Session Tokens, Cognito), Google Cloud (API Keys, OAuth, Service Accounts), Azure (Storage Keys, SAS Tokens, Connection Strings) | +| **Source Control** | GitHub (PATs, OAuth, Fine-grained tokens), GitLab (PATs, Pipeline, Runner tokens), Bitbucket | +| **Payments** | Stripe (Secret, Publishable, Restricted, Webhook), PayPal Braintree, Square | +| **Communication** | Slack (Bot, User, App tokens, Webhooks), Discord (Bot tokens, Webhooks), Telegram, Twilio, SendGrid | +| **AI / ML** | OpenAI, Anthropic, HuggingFace, Replicate | +| **Databases** | MongoDB, PostgreSQL, MySQL, Redis connection strings | +| **SaaS** | Shopify, Sentry, New Relic, PlanetScale, Linear, Notion, Datadog, Algolia, Mapbox | +| **Infrastructure** | HashiCorp Vault, Terraform, Docker Hub, NPM, Cloudflare, DigitalOcean, Doppler, Pulumi, Grafana | +| **Crypto** | RSA, EC, OpenSSH, PGP, DSA private keys | +| **Generic** | JWTs, Bearer tokens, Basic Auth, API key assignments, credential URLs, high-entropy strings | + +## How It Works + +KeyFinder scans **10 different attack surfaces** on every page: + +1. **Script `src` URLs** - Checks all script source URLs for keywords and tokens in query parameters +2. **Inline scripts** - Scans ` - - - - - +

Passive API key & secret discovery

+ - Result/s - +
+
+ - + Findings +
+
+ - + Keywords +
+
+ +
+

Keywords

+
+ + +
+ + +
+ + + + + diff --git a/results.html b/results.html index 2e81962..86a309b 100644 --- a/results.html +++ b/results.html @@ -1,67 +1,68 @@ - - - - - - - KeyFinder Results - - - - - - - - - - -
- -

KeyFinderπŸ”‘

+ + + + + KeyFinder - Findings + + + +
+
+ KeyFinder +

KeyFinder v2.0

+
+
+
+ + + + +
+
+ + + +
+
-
-

Result/s:

-

KeyfinderπŸ”‘ is a tool that let you find keys while surfing the web!

-

-

+
+ +
+ + + + + + + + + + + + + + + + +
#SeverityProviderPatternMatchTypeDomainSourceTime
+
-
- - - - - - - - - - - -
#DomainURLSearch Word
- - - - +