DEV Community

Trix Cyrus
Trix Cyrus

Posted on

I built LLMHunter to hunt exposed LLM API keys

#python #cybersecurity #ai #opensource

Author: Trix Cyrus

[🔹 Try My] Waymap Pentesting Tool

[🔹 Follow] TrixSec GitHub

[🔹 Join] TrixSec Telegram

[🔹 Tool Link] LLMHunter

LLM applications are everywhere now, and so are API keys sitting inside frontend code, JavaScript bundles, source maps, and configuration files.

So I built LLMHunter.

LLMHunter is a Python CLI tool for discovering and validating potentially exposed LLM API keys across web applications and client-side assets.

What can it find?

It currently supports:

  • Google Gemini
  • OpenAI
  • Anthropic Claude
  • NVIDIA NIM

The interesting part isn't just finding obvious strings like sk-....

LLMHunter also looks through:

  • Inline and external JavaScript
  • JSON manifests
  • Webpack chunks
  • JavaScript source maps
  • Wayback Machine snapshots
  • Obfuscated strings
  • Split string concatenations
  • Template literals
  • Base64 and hex encoded strings
  • Reversed payloads

Once a candidate key is found, LLMHunter can validate it against the relevant provider and gather additional information depending on the provider.

It can also check for things like referrer/origin restrictions and generate evidence that can be used during an authorized security assessment.

A few usage examples

Scan a target:

llmhunter example.com
Enter fullscreen mode Exit fullscreen mode

Scan multiple targets:

llmhunter -f targets.txt --concurrency 20
Enter fullscreen mode Exit fullscreen mode

Validate keys directly:

llmhunter --key-file keys.txt
Enter fullscreen mode Exit fullscreen mode

Filter by provider:

llmhunter example.com --provider openai --provider anthropic
Enter fullscreen mode Exit fullscreen mode

Generate a JSON report:

llmhunter example.com -o report.json --evidence
Enter fullscreen mode Exit fullscreen mode

I also added an offline testing sandbox with mock web targets and mock LLM providers, so the project can be tested without hitting real services.

Why I built it

A lot of credential hunting tools are really good at finding obvious patterns.

But modern web applications don't always expose credentials as a clean:

sk-xxxxxxxxxxxx
Enter fullscreen mode Exit fullscreen mode

Sometimes they're split across strings, hidden inside bundles, encoded, buried in source maps, or only present in older versions of a site.

I wanted to experiment with building something that follows those trails instead of stopping at the first regex match.

There's still a lot I want to improve, but this is a good starting point.

GitHub: https://github.com/TrixSec/llmhunter

LLMHunter is intended for authorized security testing, penetration testing, and defensive research. Don't scan targets you don't have permission to test.

~TrixSec

Top comments (0)