Token Exposure Security Testing Tool

Project Brief (Summary): Authorized Token Exposure Testing Platform

Goal
Develop a security testing tool to identify insecure handling of API tokens, session tokens, and credentials in web apps and APIs—
Mainly Telgram HTTP API tokens

Core Functions

Scan for phishing websites…,

- Traffic Analysis: Inspect and replay HTTP requests to detect tokens in headers, cookies, and responses
- Client-Side Scanning: Identify tokens or secrets in JavaScript, LocalStorage, SessionStorage, and frontend code
- Endpoint Discovery: Map API endpoints and classify authentication requirements
- Token Inspection: Decode and analyze JWTs (expiry, scope, sensitivity)
- Auth Testing: Validate whether APIs correctly enforce authentication and authorization
- Offline Analysis: Support HAR files, JS bundles, and sandboxed datasets (no live unauthorized interaction)
- Reporting: Generate redacted, file tokens.txt file with all valid telgram tokens and exposed ZIP files.




Suggested Stack
- Backend: Python or Go
- Frontend: React
- Browser automation: Playwright
- Proxy integration: Burp Suite or mitmproxy
- Deployment: Docker

Deliverables
- MVP tool with core scanning + analysis
- Secure architecture with logging and access control
- Redacted reporting system
- Documentation + test lab

Success Criteria
- Detects token exposure and insecure storage in test environments and phishing websites and stores tokens and zip files on host.
- Produces clear, reproducible findings