How devploit/geminihunter works
geminiHunter is an active scanner for exposed Google Gemini API keys in web assets, archived content, and Android packages. The principal flow is CLI inputs → discovery or supplied keys → extraction/deduplication → validation and optional 403 bypass → intelligence gathering for working keys → reports and curl evidence. The graph preserves the documented discovery and reporting capabilities; unsampled wiring is included only where the README or sampled orchestrator supports it.
Main entry points: pipeline.py Scan pipeline · session.py HTTP session · cli.py CLI inputs · validator.py Key validation
Components 22
Entry and orchestration
- CLI inputs
src/geminihunter/cli.py - Scan configuration
src/geminihunter/config.py - Scan pipeline
src/geminihunter/pipeline.py
Source discovery
- Web crawler
src/geminihunter/discovery/crawler.py - Android scanner
src/geminihunter/discovery/apk.py - Wayback assets
src/geminihunter/discovery/wayback.py - Source maps
src/geminihunter/discovery/sourcemaps.py - Webpack chunks
src/geminihunter/discovery/webpack.py - URL discovery
src/geminihunter/discovery/urlfinder.py
Key assessment
- Key extraction
src/geminihunter/extraction/extractor.py - Key validation
src/geminihunter/validation/validator.py - 403 bypass engine
src/geminihunter/validation/bypass.py - Key intelligence
src/geminihunter/intelligence/recon.py - HTTP session
src/geminihunter/network/session.py - Scan result models
src/geminihunter/models.py
Results and evidence
- Terminal report
src/geminihunter/output/console.py - JSON report
src/geminihunter/output/json_out.py - Curl evidence
src/geminihunter/output/evidence.py
Other components
- Scanner operator
- Web targets
- APK or XAPK
- Google Gemini API
Connections 25
- Scanner operator → CLI inputs: provides inputs
- CLI inputs → Scan configuration: builds config
- CLI inputs → Scan pipeline: starts scan
- Web targets → Scan pipeline: target input
- APK or XAPK → Scan pipeline: package input
- Scan pipeline → Web crawler: crawls targets
- Scan pipeline → Android scanner: scans packages
- Scan pipeline → Wayback assets: fetches archives
- Scan pipeline → Source maps: follows maps
- Scan pipeline → Webpack chunks: finds chunks
- Scan pipeline → URL discovery: finds URLs
- Web crawler → HTTP session: fetches assets
- Wayback assets → HTTP session: fetches archives
- Scan pipeline → Key extraction: extracts keys
- Scan pipeline → Key validation: validates keys
- Key validation → 403 bypass engine: probes 403s
- Key validation → HTTP session: sends requests
- Key intelligence → HTTP session: sends probes
- Scan pipeline → Key intelligence: gathers intelligence
- HTTP session → Google Gemini API: API requests
- Scan pipeline → Scan result models: builds results
- Scan pipeline → Terminal report: renders results
- Scan pipeline → JSON report: writes report
- Scan pipeline → Curl evidence: generates commands
- Curl evidence → Google Gemini API: reproduction requests