KeyHacks mostra métodos para validar diferentes chaves de API encontradas em um Programa de Bug Bounty ou pentest.

@Gwen001 criou o script de todo o processo disponível aqui e pode ser encontrado aqui

Table of Contents

• ABTasty API Key
• Algolia API key
• Amplitude API Keys
• Asana Access token
• AWS Access Key ID and Secret
• Azure Application Insights APP ID and API Key
• Bazaarvoice Passkey
• Bing Maps API Key
• Bit.ly Access token
• Branch.io Key and Secret
• BrowserStack Access Key
• Buildkite Access token
• ButterCMS API Key
• Calendly API Key
• Contentful Access Token
• CircleCI Access Token
• Cloudflare API key
• Cypress record key
• DataDog API key
• Delighted API key
• Deviant Art Access Token
• Deviant Art Secret
• Dropbox API
• Facebook Access Token
• Facebook AppSecret
• Firebase
• Firebase Cloud Messaging (FCM)
• FreshDesk API Key
• Github client id and client secret
• GitHub private SSH key
• Github Token
• Gitlab personal access token
• GitLab runner registration token
• Google Cloud Service Account credentials
• Google Maps API key
• Google Recaptcha key
• Grafana Access Token
• Help Scout OAUTH
• Heroku API key
• HubSpot API key
• Infura API key
• Instagram Access Token
• Instagram Basic Display API
• Instagram Graph API
• Ipstack API Key
• Iterable API Key
• JumpCloud API Key
• Keen.io API Key
• LinkedIn OAUTH
• Lokalise API Key
• Loqate API Key
• MailChimp API Key
• MailGun Private Key
• Mapbox API key
• Microsoft Azure Tenant
• Microsoft Shared Access Signatures (SAS)
• Microsoft Teams Webhook
• New Relic Personal API Key (NerdGraph)
• New Relic REST API
• NPM token
• OpsGenie API Key
• Pagerduty API token
• Paypal client id and secret key
• Pendo Integration Key
• PivotalTracker API Token
• Razorpay API key and secret key
• Salesforce API key
• SauceLabs Username and access Key
• SendGrid API Token
• Shodan.io
• Slack API token
• Slack Webhook
• Sonarcloud
• Spotify Access Token
• Square
• Stripe Live Token
• Telegram Bot API Token
• Travis CI API token
• Twilio Account_sid and Auth token
• Twitter API Secret
• Twitter Bearer token
• Visual Studio App Center API Token
• WakaTime API Key
• WeGlot Api Key
• WPEngine API Key
• YouTube API Key
• Zapier Webhook Token
• Zendesk Access token
• Zendesk API key

Detailed Information

Slack Webhook

Se o comando abaixo retornar missing_text_or_fallback_or_attachments, significa que a URL é válida, qualquer outra resposta significaria que a URL é inválida.``` curl -s -X POST -H "Content-type: application/json" -d '{"text":""}' "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"

## [Token da API do Slack](https://api.slack.com/web)```
curl -sX POST "https://slack.com/api/auth.test?token=xoxp-TOKEN_HERE&pretty=1"

ou``` curl -sX POST "https://slack.com/api/auth.test" -H "Accept: application/json; charset=utf-8" -H "Authorization: Bearer xoxb-TOKEN_HERE"

## [SauceLabs Nome de usuário e chave de acesso](https://wiki.saucelabs.com/display/DOCS/Account+Methods)```
curl -u USERNAME:ACCESS_KEY https://saucelabs.com/rest/v1/users/USERNAME

Facebook AppSecret

Você pode gerar tokens de acesso visitando a URL abaixo.``` https://graph.facebook.com/oauth/access_token?client_id=ID_HERE&client_secret=SECRET_HERE&redirect_uri=&grant_type=client_credentials

## Token de Acesso do Facebook```
https://developers.facebook.com/tools/debug/accesstoken/?access_token=ACCESS_TOKEN_HERE&version=v3.2

Firebase

Requer um token personalizado e uma chave de API.

1. Obtenha o token de ID e o token de atualização a partir do token personalizado e da chave de API: curl -s -XPOST -H 'content-type: application/json' -d '{"token":":custom_token","returnSecureToken":True}' 'https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=:api_key'
2. Troque o token de ID pelo token de autenticação: curl -s -XPOST -H 'content-type: application/json' -d '{"idToken":":id_token"}' https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyCustomToken?key=:api_key'

Github Token```

curl -s -u "user:apikey" https://api.github.com/user curl -s -H "Authorization: token TOKEN_HERE" "https://api.github.com/users/USERNAME_HERE/orgs"

Check scope of your api token

curl "https://api.github.com/rate_limit" -i -u "user:apikey" | grep "X-OAuth-Scopes:"

## [ID e segredo do cliente do Github](https://developer.github.com/v3/#oauth2-keysecret)```
curl 'https://api.github.com/users/whatever?client_id=xxxx&client_secret=yyyy'

Firebase Cloud Messaging

Referência: https://abss.me/posts/fcm-takeover``` curl -s -X POST --header "Authorization: key=AI..." --header "Content-Type:application/json" 'https://fcm.googleapis.com/fcm/send' -d '{"registration_ids":["1"]}'

## Chave SSH privada do GitHub