harezadmm/omp-enhanced/api-key-pentesting

import secrets
from collections import Counter
keys = [
    "lv-8XY2cjOC4ziGFrznSHo8yvXqdDmlh9Yk",  # working
    "lv-9lBj0zjlN4kGuudnq1qU1UWbLrT9FRy9",  # expired
]
for key in keys:
    prefix = key[:3]
    body = key[3:]
    print(f"Prefix: {prefix}, Length: {len(body)}")
    print(f"  Upper: {sum(1 for c in body if c.isupper())}")
    print(f"  Lower: {sum(1 for c in body if c.islower())}")
    print(f"  Digits: {sum(1 for c in body if c.isdigit())}")
    print(f"  Special: {[c for c in body if not c.isalnum()]}")

import requests
base_url = "https://router.example.com"
test_key = "lv-WORKING-KEY"
endpoints = [
    "/api/v1/models",
    "/api/keys/generate",
    "/api/keys/create",
    "/register",
    "/api/auth/login",
]
for endpoint in endpoints:
    r = requests.get(f"{base_url}{endpoint}",
                    headers={"Authorization": f"Bearer {test_key}"},
                    timeout=10)
    if r.status_code != 404:
        print(f"✅ {endpoint}: {r.status_code}")

response = requests.get(
    f"{base_url}/api/v1/models",
    headers={"Authorization": f"Bearer {working_key}"}
)
if response.status_code == 200:
    data = response.json()
    models = [m['id'] for m in data.get('data', [])]
    print(f"✅ Valid - {len(models)} models available")

def generate_key():
    body = secrets.token_urlsafe(24)  # 24 bytes → ~32 chars
    return f"lv-{body}"
candidates = [generate_key() for _ in range(30)]

import time
for i, key in enumerate(candidates, 1):
    r = requests.get(f"{base_url}/api/v1/models",
                    headers={"Authorization": f"Bearer {key}"})
    
    status = "✅ WORKING" if r.status_code == 200 else "❌ Invalid"
    print(f"[{i:2}/30] {status}")
    time.sleep(1)  # Rate limiting