180 lines
6.7 KiB
Markdown
180 lines
6.7 KiB
Markdown
# LLM Key Hunter
|
||
|
||
全网泄露 LLM API Key 搜索 & 验证工具 — 覆盖国际 + 中国 LLM 平台。
|
||
|
||
## 架构
|
||
|
||
```
|
||
llm-key-hunter/
|
||
├── llm-key-hunter.sh # 主入口，参数解析 + pipeline 调度
|
||
├── verify.sh # Key 验证模块 — 25 个 provider 调 API 确认 live
|
||
├── scan.sh # TruffleHog 深度扫描模块 — 扫 org/user 全 history
|
||
├── gist.sh # GitHub Gist 扫描模块 — 公开 gist 是泄露重灾区
|
||
├── patterns.conf # 正则指纹库 — 所有 LLM provider 的 key 格式
|
||
└── results/ # 输出目录
|
||
```
|
||
|
||
## 支持的 LLM Provider
|
||
|
||
### 国际平台
|
||
|
||
| Provider | Key 格式 | 验证 Endpoint |
|
||
|---|---|---|
|
||
| OpenAI | `sk-...` / `sk-proj-...` | `api.openai.com/v1/models` |
|
||
| Anthropic | `sk-ant-...` | `api.anthropic.com/v1/models` |
|
||
| Google Gemini | `AIza...` | `generativelanguage.googleapis.com` |
|
||
| HuggingFace | `hf_...` | `huggingface.co/api/whoami-v2` |
|
||
| Groq | `gsk_...` | `api.groq.com/openai/v1/models` |
|
||
| Replicate | `r8_...` | `api.replicate.com/v1/account` |
|
||
| Together AI | 64-char hex | `api.together.xyz/models` |
|
||
| Mistral | 32-char alnum | `api.mistral.ai/v1/models` |
|
||
| Cohere | 40-char alnum | `api.cohere.ai/v1/models` |
|
||
| DeepSeek | `sk-` + 32 hex | `api.deepseek.com/v1/models` |
|
||
| Perplexity | `pplx-...` | `api.perplexity.ai` |
|
||
| OpenRouter | `sk-or-...` | `openrouter.ai/api/v1/models` |
|
||
| Azure OpenAI | 32-char hex | (降级到 OpenAI 验证) |
|
||
|
||
### 中国平台
|
||
|
||
| Provider | Key 格式 | 验证 Endpoint | Auth |
|
||
|---|---|---|---|
|
||
| 火山引擎 Ark | UUID `[0-9a-f]{8}-...` | `ark.cn-beijing.volces.com/api/v3/models` | Bearer |
|
||
| 火山 Coding Plan | UUID (同上) | `ark.cn-beijing.volces.com/api/coding/v1/models` | Bearer |
|
||
| 智谱 AI (ChatGLM) | `APIKey.APISecret` (dot) | `open.bigmodel.cn/api/paas/v4/models` | Bearer |
|
||
| 阿里云 DashScope | `sk-` + 32 chars | `dashscope.aliyuncs.com/compatible-mode/v1/models` | Bearer |
|
||
| Kimi (Moonshot) | `sk-` + 48 chars | `api.moonshot.cn/v1/models` | Bearer |
|
||
| MiniMax | 40+ char alnum | `api.minimaxi.com/v1/models` | Bearer |
|
||
| 腾讯混元 | `AKID...` 或 alnum | `api.hunyuan.cloud.tencent.com/v1/models` | Bearer |
|
||
| 百度千帆 | 20-32 char alnum | `qianfan.baidubce.com/v2/models` | Bearer |
|
||
| 讯飞星火 (Spark) | `UUID:APISecret` | `spark-api.xf-yun.com/v1/chat/completions` | HMAC |
|
||
| 讯飞星辰 (Coding Plan) | 32+ char alnum | `maas-coding-api.cn-huabei-1.xf-yun.com/v2` | Bearer |
|
||
| 零一万物 (01.AI) | `sk-` + 48 chars | `api.lingyiwanwu.com/v1/models` | Bearer |
|
||
| 阶跃星辰 (StepFun) | `sk-` + 48 chars | `api.stepfun.com/v1/models` | Bearer |
|
||
| 硅基流动 (SiliconFlow) | `sk-` + 48 chars | `api.siliconflow.cn/v1/models` | Bearer |
|
||
|
||
> **注:** 豆包 (Doubao) 通过火山引擎 Ark 平台，key 格式同 VolcanoArk。
|
||
> 讯飞星火使用 HMAC 签名认证，无法简单 Bearer 验证，仅做格式校验。
|
||
> 讯飞星辰 Coding Plan 使用 OpenAI 兼容协议，Bearer auth，可直接验证。
|
||
|
||
## 快速开始
|
||
|
||
```bash
|
||
# 设置 GitHub token
|
||
export GH_TOKEN="ghp_your_token_here"
|
||
|
||
# 完整 pipeline: 广搜 → 提取 → 验证 (覆盖所有平台)
|
||
./llm-key-hunter.sh full -t ghp_xxx -v
|
||
|
||
# 只做 GitHub 全局广搜
|
||
./llm-key-hunter.sh broad -t ghp_xxx
|
||
|
||
# 深度扫描指定 org (trufflehog)
|
||
./llm-key-hunter.sh scan -o target-org -t ghp_xxx --deep
|
||
|
||
# 扫描公开 Gist
|
||
./llm-key-hunter.sh gist -t ghp_xxx
|
||
|
||
# 只验证已有候选 key
|
||
./llm-key-hunter.sh verify
|
||
|
||
# Raw 模式：跳过验证，只做正则匹配
|
||
./llm-key-hunter.sh full -t ghp_xxx --raw
|
||
```
|
||
|
||
## Pipeline 流程
|
||
|
||
```
|
||
gh search code (广搜定位候选文件 — 60+ 查询覆盖国际+中国平台)
|
||
↓
|
||
candidates.json
|
||
↓
|
||
curl raw content (拉取文件内容)
|
||
↓
|
||
regex match (正则提取 key — 25 个 provider pattern)
|
||
↓
|
||
extracted_keys.txt
|
||
↓
|
||
API verify (逐个调 provider API 验证 — 25 个 verify 函数)
|
||
↓
|
||
live_keys.txt / dead_keys.txt
|
||
↓
|
||
trufflehog (对高价值目标深度补刀)
|
||
```
|
||
|
||
## 输出文件
|
||
|
||
### 总表
|
||
|
||
| 文件 | 说明 |
|
||
|---|---|
|
||
| `results/candidates.json` | 广搜候选文件列表 |
|
||
| `results/extracted_keys.txt` | 正则提取的候选 key |
|
||
| `results/live_keys.txt` | 验证通过的 live key (总表) |
|
||
| `results/dead_keys.txt` | 验证失败的 dead key |
|
||
| `results/verified_all.txt` | 完整验证结果 |
|
||
| `results/trufflehog_results.json` | TruffleHog 深扫结果 |
|
||
| `results/gist_keys.txt` | Gist 扫描结果 |
|
||
|
||
### 按厂商分类的 Live Keys
|
||
|
||
验证通过的 key 会按厂商和地区分类存储：
|
||
|
||
```
|
||
results/live/
|
||
├── international/ # 国际平台
|
||
│ ├── openai.txt
|
||
│ ├── anthropic.txt
|
||
│ ├── google_gemini.txt
|
||
│ ├── huggingface.txt
|
||
│ ├── groq.txt
|
||
│ ├── deepseek.txt
|
||
│ └── ...
|
||
└── china/ # 中国平台
|
||
├── volcano_ark.txt # 火山引擎
|
||
├── zhipu_chatglm.txt # 智谱 AI
|
||
├── alibaba_dashscope.txt # 阿里云通义
|
||
├── kimi_moonshot.txt # Kimi
|
||
├── minimax.txt # MiniMax
|
||
├── tencent_hunyuan.txt # 腾讯混元
|
||
├── baidu_qianfan.txt # 百度千帆
|
||
├── iflytek_spark.txt # 讯飞星火
|
||
├── iflytek_coding_plan.txt # 讯飞星辰 Coding Plan
|
||
├── lingyiwanwu_01ai.txt # 零一万物
|
||
├── stepfun.txt # 阶跃星辰
|
||
└── siliconflow.txt # 硅基流动
|
||
```
|
||
|
||
每个文件格式: `Provider|Key|SourceURL|Description`
|
||
|
||
## 自定义正则模式
|
||
|
||
编辑 `patterns.conf`，格式为 `Provider|Regex|Description`：
|
||
|
||
```
|
||
MyProvider|mykey-[a-zA-Z0-9]{32}|Custom provider key
|
||
```
|
||
|
||
## 搜索查询覆盖
|
||
|
||
主脚本内置 60+ 条 GitHub code search 查询，覆盖：
|
||
|
||
- **文件类型**: `.env`, `.py`, `.js`, `.ts`, `.sh`, `.cfg`, `.ini`, `.ipynb`
|
||
- **国际平台**: OpenAI, Anthropic, Google, HuggingFace, Groq, Replicate 等
|
||
- **中国平台**: 火山 Ark, 智谱, 阿里 DashScope, Kimi, MiniMax, 腾讯混元, 百度千帆, 讯飞, 零一万物, 阶跃星辰, 硅基流动
|
||
- **搜索策略**: 既搜 key 前缀 (`sk-proj-`, `sk-ant-`)，也搜环境变量名 (`ARK_API_KEY`, `DASHSCOPE_API_KEY`)，还搜 API endpoint URL
|
||
|
||
## 依赖
|
||
|
||
- `gh` (GitHub CLI) — 必需
|
||
- `curl` — 必需
|
||
- `jq` — 必需
|
||
- `trufflehog` — scan 模式需要，自动安装
|
||
|
||
## 注意
|
||
|
||
- GitHub code search 每次最多 1000 条结果，脚本用 60+ 个查询变体覆盖
|
||
- 验证 key 会向 provider API 发真实请求，注意速率限制
|
||
- `--only-verified` (trufflehog) 只输出实际验证通过的 key，误报率最低
|
||
- 讯飞星火使用 HMAC 签名，无法简单验证，仅做格式校验
|
||
- 腾讯混元 key 格式灵活，可能有较高误报率
|