GCP - API Sleutels Ongeauthentiseerde Enum

Tip

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Leer & oefen Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

API Sleutels

Vir meer inligting oor API Sleutels, kyk:

GCP - API Keys Enum

OSINT tegnieke

Google API Sleutels word wyd gebruik deur enige soort toepassings wat van die kliëntkant gebruik maak. Dit is algemeen om hulle in webwerf se bronkode of netwerk versoeke te vind, in mobiele toepassings of net deur regexes te soek op platforms soos Github.

Die regex is: AIza[0-9A-Za-z_-]{35}

Soek dit byvoorbeeld in Github soos: https://github.com/search?q=%2FAIza%5B0-9A-Za-z_-%5D%7B35%7D%2F&type=code&ref=advsearch

Kontroleer oorsprong GCP projek

Dit is uiters nuttig om te kontroleer tot watter GCP projek ’n API sleutel wat jy gevind het behoort. Ons het verskillende opsies:

  • Kontak https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=<api-key

Vir die doeleindes van beknoptheid is die uitvoer afgekort, maar in die volledige uitvoer verskyn die projek ID meer as 5 keer.

curl -s "https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=AIzaSyD[...]uE8Y"

{
"error": {
"code": 403,
"message": "Identity Toolkit API has not been used in project 943955951114 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=943955951114 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
[...]
  • Kontak https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=<api-key>

Vir die doeleindes van beknoptheid is die uitvoer afgekort, maar in die volledige uitvoer verskyn die projek-ID meer as 5 keer.

curl -s "https://identitytoolkit.googleapis.com/v1/projects?key=AIzaSyD[...]uE8Y"

{
"error": {
"code": 403,
"message": "Identity Toolkit API has not been used in project 943955951114 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=943955951114 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
[...]
  • [Hierdie een werk nie meer nie!] apikeys.keys.lookup
# If you have permissions
gcloud services api-keys lookup AIzaSyD[...]uE8Y
name: projects/5[...]6/locations/global/keys/28d[...]e0e
parent: projects/5[...]6/locations/global

# If you don't, you can still see the project ID in the error msg
gcloud services api-keys lookup AIzaSy[...]Qbkd_oYE
ERROR: (gcloud.services.api-keys.lookup) PERMISSION_DENIED: Permission 'apikeys.keys.lookup' denied on resource project.
Help Token: ARD_zUaNgNilGTg9oYUnMhfa3foMvL7qspRpBJ-YZog8RLbTjCTBolt_WjQQ3myTaOqu4VnPc5IbA6JrQN83CkGH6nNLum6wS4j1HF_7HiCUBHVN
- '@type': type.googleapis.com/google.rpc.PreconditionFailure
violations:
- subject: ?error_code=110002&service=cloudresourcemanager.googleapis.com&permission=serviceusage.apiKeys.getProjectForKey&resource=projects/89123452509
type: googleapis.com
- '@type': type.googleapis.com/google.rpc.ErrorInfo
domain: apikeys.googleapis.com
metadata:
permission: serviceusage.apiKeys.getProjectForKey
resource: projects/89123452509
service: cloudresourcemanager.googleapis.com
reason: AUTH_PERMISSION_DENIED

Brute Force API eindpunte

Soos jy dalk nie weet watter API’s in die projek geaktiveer is nie, sal dit interessant wees om die hulpmiddel https://github.com/ozguralp/gmapsapiscanner te gebruik en te kyk wat jy met die API-sleutel kan toegang.

Tip

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Leer & oefen Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks