Supabase Hunter (OP Mode)

Advanced Reconnaissance & Exploitation Tool for Supabase Instances.

SupaHunter is a powerful Python tool designed to identify, analyze, and exploit misconfigured Supabase projects. It goes beyond simple table enumeration, offering deep inspection capabilities, Selenium-based key extraction, and advanced privilege escalation checks.

Key Features

• Advanced Discovery:
  • OpenAPI Inspection: Automatically fetches and parses /rest/v1/ to map the entire database schema.
  • RPC Enumeration: Probes for hidden RPC functions (get_schema, exec_sql, etc.).
  • Smart Bruteforce: Uses SecLists (auto-downloaded) to find hidden tables if OpenAPI is disabled.
• Selenium Integration:
  • Dynamic Analysis: Renders React/Next.js apps to find keys hidden in the DOM or Runtime.
  • Traffic Sniffer: Injects a hook to intercept fetch/XHR requests and extract apikey and Authorization headers on the fly.
• RLS Bypass Check:
  • Performs REAL POST, PATCH, and DELETE requests (safe mode) to verify if Row Level Security is actually enforced or just a facade.
• Realtime Listener:
  • Connects to Supabase Realtime (Phoenix V2) to intercept live data streams (INSERT, UPDATE events).
• SERVICE MODE (Service Role):
  • Automatically detects service_role keys.
  • Admin Dump: Downloads auth.users (emails, hashes if possible), Storage Buckets, and so on.
• Multi-Tenant Support:
  • Handles sites using multiple Supabase projects simultaneously.
• Full Data Dump:
  • Exports everything to a clean SQLite database (dump.db) and/or CSV files.
  • Downloads files from public/private Storage Buckets.

Installation

1. Clone the repo:

   root@kitploit:~

   git clone https://github.com/proxydom/supahunter.git
   cd supahunter
   

2. Install dependencies:

   root@kitploit:~

   pip install -r requirements.txt
   

   (Requires requests, selenium, webdriver-manager, websockets)

3. Install Firefox (for Selenium): The tool uses Firefox Headless. Ensure it is installed (it should download it automatically, tho)

Usage

Basic Scan

Scan a single URL for exposed keys and tables.

python3 supahunter.py https://target.com

Mass Scan (File Input)

Scan a list of URLs with Selenium enabled and save results to SQLite.

python3 supahunter.py -f targets.txt --selenium --sqlite --download-files

Manual Credentials

If you already have the API URL and Key, use them directly (works for service_role keys too!).

python3 supahunter.py --manual-url https://xyz.supabase.co --manual-key eyJ... ---manual-url projectid.supabase.com

Authenticated Scan (Privilege Escalation)

Provide a user JWT token (or credentials) to test RLS bypass for authenticated users.

python3 supahunter.py https://target.com --token "eyJ..."

Or let the tool try auto-signup: --email [email protected] --password Hunter123!

God Mode (Service Key)

If a service_role key is detected, the tool automatically switches to SERVICE MODE, dumping auth.users, audit logs, and all storage buckets.

Options

⚠️ Disclaimer

This tool is for educational purposes and authorized security testing only. Accessing or modifying data without permission is illegal. The author is not responsible for any misuse.

Happy Hunting and stay legal boys :)