DEF CON 34 Demo Labs: KeyChecker

Official Website link

• DEF CON 34 Demo Labs — KeyChecker

Event: DEF CON 34 (Las Vegas)
Venue: LVCC - L1 - Exhibit Hall West 3 - 1003
Track: Demo Labs Track 3
Format: 45-minute Demo Lab (two sessions)
Presenter: Anant Shrivastava | Founder, Cyfinoid Research

Schedule

• Saturday, August 8, 2026 · 12:00 – 12:45 · Demo Labs Track 3
• Saturday, August 8, 2026 · 13:00 – 13:45 · Demo Labs Track 3

Audience: DevOps, SecOps, Offense/Red Team, Defense/Blue Team

Demo Lab Overview

KeyChecker is a CLI tool to fingerprint SSH private keys and identify which Git hosting accounts they unlock. In incident response and red team work, finding a private key is common, but scoping impact is slow and manual. KeyChecker automates the two primitives defenders and attackers both use: safe SSH handshakes that can reveal the mapped username, and read-only git ls-remote probes that confirm whether a key can access a target repo.

The tool performs local key intelligence first, supporting OpenSSH, PEM, and DER formats, detecting key type (ed25519, rsa, ecdsa, dsa), key size, passphrase protection, fingerprints (SHA256 and MD5), and useful metadata from key comments. It then validates the key across multiple providers including GitHub, GitLab, Bitbucket, Codeberg, Gitea, and Hugging Face, extracting usernames where possible, and optionally using a GitHub token for organization discovery.

KeyChecker also supports repository discovery with a wordlist and configurable concurrency, giving a clear blast radius report like “this key unlocks these private repositories.” It is designed for authorized assessments, runs locally, and avoids write operations.

Resources

• Source Code: GitHub Repository
• PyPI: keychecker