API Key Leaks Payloads & Testing Methodology

nuclei -t token-spray/ -var token=token_list.txt

API Key and Token Leaks#

API keys and tokens are forms of authentication commonly used to manage permissions and access to both public and private services. Leaking these sensitive pieces of data can lead to unauthorized access, compromised security, and potential data breaches.

Tools#

aquasecurity/trivy - General purpose vulnerability and misconfiguration scanner which also searches for API keys/secrets.
blacklanternsecurity/badsecrets - A library for detecting known or weak secrets on across many platforms.
irsdl/crapsecrets - A library for detecting known secrets across many web frameworks.
d0ge/sign-saboteur - SignSaboteur is a Burp Suite extension for editing, signing, verifying various signed web tokens.
mazen160/secrets-patterns-db - Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.
momenbasel/KeyFinder - is a tool that let you find keys while surfing the web.
streaak/keyhacks - is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.
trufflesecurity/truffleHog - Find credentials all over the place.
projectdiscovery/nuclei-templates - Use these templates to test an API token against many API service endpoints.

powershell1 line

    nuclei -t token-spray/ -var token=token_list.txt

Methodology#

**API Keys**: Unique identifiers used to authenticate requests associated with your project or application.
**Tokens**: Security tokens (like OAuth tokens) that grant access to protected resources.

Common Causes of Leaks#

**Hardcoding in Source Code**: Developers may unintentionally leave API keys or tokens directly in the source code.

py2 lines

    # Example of hardcoded API key
    api_key = "1234567890abcdef"

**Public Repositories**: Accidentally committing sensitive keys and tokens to publicly accessible version control systems like GitHub.

ps15 lines

    ## Scan a Github Organization
    docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --org=trufflesecurity
    
    ## Scan a GitHub Repository, its Issues and Pull Requests
    docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys --issue-comments --pr-comments

**Hardcoding in Docker Images**: API keys and credentials might be hardcoded in Docker images hosted on DockerHub or private registries.

ps12 lines

    # Scan a Docker image for verified secrets
    docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest docker --image trufflesecurity/secrets

**Logs and Debug Information**: Keys and tokens might be inadvertently logged or printed during debugging processes.

**Configuration Files**: Including keys and tokens in publicly accessible configuration files (e.g., .env files, config.json, settings.py, or .aws/credentials.).

Validate The API Key#

If assistance is needed in identifying the service that generated the token, mazen160/secrets-patterns-db can be consulted. It is the largest open-source database for detecting secrets, API keys, passwords, tokens, and more. This database contains regex patterns for various secrets.

yaml9 lines

patterns:
  - pattern:
      name: AWS API Gateway
      regex: '[0-9a-z]+.execute-api.[0-9a-z._-]+.amazonaws.com'
      confidence: low
  - pattern:
      name: AWS API Key
      regex: AKIA[0-9A-Z]{16}
      confidence: high

Use streaak/keyhacks or read the documentation of the service to find a quick way to verify the validity of an API key.

**Example**: Telegram Bot API Token

ps11 line

    curl https://api.telegram.org/bot<TOKEN>/getMe

Reducing The Attack Surface#

Check the existence of a private key or AWS credentials before committing your changes in a GitHub repository.

Add these lines to your .pre-commit-config.yaml file.

yml5 lines

-   repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v3.2.0
    hooks:
    -   id: detect-aws-credentials
    -   id: detect-private-key