Algopwn

Algopwn — Algolia API Key Analyzer & (authorized) Exploiter

Algopwn helps security practitioners quickly assess Algolia API key exposures. The tool prompts for App ID and API key, fetches key metadata and ACLs, and classifies keys as informative (read-only) or sensitive (modifiable). For sensitive keys, Algopwn lists indexes, fetches index data and settings, and — only after interactive confirmation — can apply a reversible PoC update and print a copy-paste verification URL.

⚠️ Important: Only use Algopwn against applications you own or have explicit written permission to test (bug bounty scope, pentest engagement, etc.). Misuse may be illegal and unethical.

---

Features

• Prompt-based interactive workflow (no required CLI args).
• Fetches key metadata and ACLs from Algolia.
• Distinguishes informative (read-only) ACLs vs sensitive (modify/delete) ACLs.
• If sensitive ACLs are present, lists indexes and allows you to:
  • fetch index data (single index),
  • fetch index settings,
  • optionally update highlightPreTag to a PoC value (e.g., "hacked").
• Prints a copy-paste PoC verification URL after a successful update.
• Colorised terminal output for readability.
• Small, dependency-light: uses requests and colorama.

Installation

1. Clone the repo:

   git clone https://github.com/Suryesh/Algopwn.git
   cd Algopwn
   

2. Install dependencies:

    pip install requests colorama
   

---

Help

python3 algopwn.py -h

⚠️ Important: You need to change one line of code before using this tool:

Line number 82: payload = {"highlightPreTag": "Hacked by Suryesh"}
- change highlightPreTag syntax with your name i.e, {"highlightPreTag": "Hacked by (yourname-xyz)"}

Usage

1. Run the script python3 algopwn.py and follow the prompts:
2. Enter the Algolia App ID and API key when prompted.
3. The tool prints key info (JSON), then:
   • If the key is informative only (e.g., search, listIndexes, settings), the tool reports this and exits.
   • If the key is sensitive (e.g., editSettings, addObject, deleteIndex), the tool asks if you want to proceed with exploitation steps.
4. If you choose to proceed, you can pick an index, view its data/settings, and confirm an update. After updating, a PoC URL is printed.

python3 algopwn.py

   _   _               ___
  /_\ | | __ _  ___   / _ \__      ___ __
 //_\\| |/ _` |/ _ \ / /_)/\ \ /\ / / '_ \
/  _  \ | (_| | (_) / ___/  \ V  V /| | | |
\_/ \_/_|\__, |\___/\/       \_/\_/ |_| |_|
         |___/

      Algolia API Key Exploiter by Suryesh

You can follow me on Twitter/X: https://x.com/Suryesh_92

Subscribe to my Youtube Channel: https://www.youtube.com/@HackWithSuryesh

Enter Algolia Application ID: MH9A52MZTO
Enter Algolia API Key: 4d89644522b528406ec821a713da60fe

{ "info": { ... } }

This key only has ['search'] permissions. So, it is Informative only.


If a sensitive key is detected:

This key has sensitive ACLs: ['editSettings', 'deleteObject', etc.]
Do you want to proceed with exploitation? (y/n): y

Indexes available:
1. products_v1
2. users_public

Enter the index name to work with: products_v1
[fetch data]
[fetch settings]

Do you want to update this index's settings with payload (highlightPreTag=Hacked by Suryesh)? (y/n): y
[+] Update Response: {...}

[+] PoC Verification URL:
https://MH9A52MZTO-dsn.algolia.net/1/indexes/products_v1/settings?x-algolia-application-id=MH9A52MZTO&x-algolia-api-key=4d896...

Video PoC:

<p align="center"> <a href="https://www.youtube.com/watch?v=DtSpnyILWd4" target="_blank"> <img src="https://img.youtube.com/vi/DtSpnyILWd4/hqdefault.jpg" alt="Algopwn PoC video" width="720"/> </a> </p>

References/Write-up:

You may follow my social media:

<p align="center"> <a href="https://x.com/Suryesh_92"><img src="https://img.shields.io/badge/Twitter-@Suryesh__92-blue?logo=twitter&logoColor=white" alt="Twitter"></a> <a href="https://www.youtube.com/@HackWithSuryesh"><img src="https://img.shields.io/badge/YouTube-Subscribe-red?logo=youtube&logoColor=white" alt="YouTube"></a> <a href="https://medium.com/@hackwithsuryesh"><img src="https://img.shields.io/badge/Medium-Blog-black?logo=medium&logoColor=white" alt="Medium"></a> <a href="https://instagram.com/suryesh_92"><img src="https://img.shields.io/badge/Instagram-Follow-pink?logo=instagram&logoColor=white" alt="Instagram"></a> <a href="https://www.linkedin.com/in/dhananjay-kumar-suryesh-535995220/"><img src="https://img.shields.io/badge/LinkedIn-Connect-blue?logo=linkedin&logoColor=white" alt="LinkedIn"></a> <a href="https://discord.com/invite/EfgnVNbh3N"><img src="https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white" alt="Discord"></a> </p>

License

This project is licensed under the MIT License. See the file for details.

💰 You can help me by Donating

Disclaimer

This tool is intended for educational and ethical testing purposes only. Do not use it for any illegal or unauthorized activities. The author is not responsible for any misuse of this tool.