Official Website link
Date: Wednesday, August 5 | 4:00pm-5:00pm
Event: BlackHat USA 2026 Arsenal
Location: Arsenal Station 1, Business Hall
Track: Vulnerability Assessment
Presenter: Anant Shrivastava
KeyChecker is a CLI tool to fingerprint SSH private keys and identify which Git hosting accounts they unlock. In incident response and red team work, finding a private key is common, but scoping impact is slow and manual. KeyChecker automates the two primitives defenders and attackers both use: safe SSH handshakes that can reveal the mapped username, and read-only git ls-remote probes that confirm whether a key can access a target repo.
The tool performs local key intelligence first, supporting OpenSSH, PEM, and DER formats, detecting key type (ed25519, rsa, ecdsa, dsa), key size, passphrase protection, fingerprints (SHA256 and MD5), and useful metadata from key comments. It then validates the key across multiple providers including GitHub, GitLab, Bitbucket, Codeberg, Gitea, and Hugging Face, extracting usernames where possible, and optionally using a GitHub token for organization discovery.
KeyChecker also supports repository discovery with a wordlist and configurable concurrency, giving a clear blast radius report like “this key unlocks these private repositories.” It is designed for authorized assessments, runs locally, and avoids write operations.
Resources
- Source Code: GitHub Repository
- PyPI: keychecker
