Everything K-culture — comebacks to K-beauty, straight to your inboxGet it in your inbox

METAL MEDIA

lifefloating/keyHunter-skill

★ 28Python

A CLI toolkit that finds exposed AI gateway admin panels and tests them for weak credentials, meant only for authorized security research

keyHunter is a Python command-line tool built for studying security weaknesses in AI gateway/quota management panels such as Sub2API, New-API and One-API. It chains together internet search (via FOFA), fingerprinting of live targets, weak-password credential testing, and normalization of the results into JSON files. The project's license and README explicitly restrict its use to systems the user owns or has written authorization to test.

What it does

  1. Runs a pipeline: FOFA search to find candidate hosts, fingerprinting to confirm which panel type they run, credential testing against a bundled weak-password list (about 489 entries), account data export, and normalization of results into standard JSON artifacts.
  2. Supports three panel families out of the box: Sub2API (email login), New-API and One-API (username login, with an IDOR-style token/channel access pattern), each with documented login and export endpoints.
  3. Credential testing follows a fixed order: built-in known combos first, then dictionary passwords per email; it logs but does not exploit non-admin sessions, and by default runs the full credential list unless a max-attempts limit is set.
  4. Only writes tokens to disk and never prints secrets to the console; a separate validate command checks whether captured tokens are parseable and not expired before treating them as usable.
  5. Ships as an agentskills.io-compatible SKILL.md so tools like Claude Code or Codex CLI can load it as an automated operating manual.
  6. The README and a dedicated 'Defensive Security Source License' state the tool is for authorized, defensive academic research only, explicitly banning scanning or credential use against systems without explicit written permission.

Why it matters

This shows how AI-agent-oriented coding tools are now packaging security research workflows as installable 'skills' that agents like Claude Code can execute directly. For readers building or defending AI gateway/quota panels, it's a concrete illustration of the kind of automated reconnaissance and credential-testing pipeline attackers or researchers might use against exposed admin panels, and a reminder that authorization boundaries matter even when a tool is framed as 'defensive'.

Terms in this repo

  • FOFA · a search engine that indexes internet-connected devices and services, used to find candidate targets
  • fingerprinting · probing a server to identify what software/product it is running
  • credential stuffing / spray (撞库) · systematically trying known or common username/password combinations against a login system
  • IDOR · Insecure Direct Object Reference, a flaw where changing an ID in a request lets you access another user's data
  • JWT · JSON Web Token, a compact signed token format commonly used for login sessions

Repository description (English)

Academic research toolkit for AI gateway panel security studies (Sub2API / New-API / One-API): FOFA discovery, fingerprinting, credential-hygiene testing, artifact normalization. Authorized, defensive use only.

Open on GitHub

Trending repos

All repos →

Latest from METAL MEDIA