KeyHacks 展示了在漏洞赏金计划或渗透测试中发现的不同 API 密钥的验证方法。
@Gwen001 已将整个过程编写成脚本，可在此处获取：here
如果以下命令返回 missing_text_or_fallback_or_attachments，则表示该 URL 有效，任何其他响应则表示该 URL 无效。```
curl -s -X POST -H "Content-type: application/json" -d '{"text":""}' "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"
## [Slack API 令牌](https://api.slack.com/web)```
curl -sX POST "https://slack.com/api/auth.test?token=xoxp-TOKEN_HERE&pretty=1"
或者``` curl -sX POST "https://slack.com/api/auth.test" -H "Accept: application/json; charset=utf-8" -H "Authorization: Bearer xoxb-TOKEN_HERE"
## [SauceLabs 用户名和访问密钥](https://wiki.saucelabs.com/display/DOCS/Account+Methods)```
curl -u USERNAME:ACCESS_KEY https://saucelabs.com/rest/v1/users/USERNAME
您可以通过访问以下URL来生成访问令牌。``` https://graph.facebook.com/oauth/access_token?client_id=ID_HERE&client_secret=SECRET_HERE&redirect_uri=&grant_type=client_credentials
## Facebook 访问令牌```
https://developers.facebook.com/tools/debug/accesstoken/?access_token=ACCESS_TOKEN_HERE&version=v3.2
需要自定义令牌和API密钥。
curl -s -XPOST -H 'content-type: application/json' -d '{"token":":custom_token","returnSecureToken":True}' 'https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=:api_key'curl -s -XPOST -H 'content-type: application/json' -d '{"idToken":":id_token"}' https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyCustomToken?key=:api_key'curl -s -u "user:apikey" https://api.github.com/user curl -s -H "Authorization: token TOKEN_HERE" "https://api.github.com/users/USERNAME_HERE/orgs"
curl "https://api.github.com/rate_limit" -i -u "user:apikey" | grep "X-OAuth-Scopes:"
## [Github客户端ID和客户端密钥](https://developer.github.com/v3/#oauth2-keysecret)```
curl 'https://api.github.com/users/whatever?client_id=xxxx&client_secret=yyyy'
参考：https://abss.me/posts/fcm-takeover``` curl -s -X POST --header "Authorization: key=AI..." --header "Content-Type:application/json" 'https://fcm.googleapis.com/fcm/send' -d '{"registration_ids":["1"]}'
## GitHub 私有 SSH 密钥
SSH 私钥可以针对 github.com 进行测试，以查看它们是否已注册到现有用户账户。如果密钥存在，将提供与该密钥对应的用户名。([source](https://github.com/streaak/keyhacks/issues/2))```
$ ssh -i <path to SSH private key> -T [email protected]
Hi <username>! You've successfully authenticated, but GitHub does not provide shell access.
curl -X GET 'https://api.twilio.com/2010-04-01/Accounts.json' -u ACCOUNT_SID:AUTH_TOKEN
## [Twitter API 密钥](https://developer.twitter.com/en/docs/basics/authentication/guides/bearer-tokens.html)```
curl -u 'API key:API secret key' --data 'grant_type=client_credentials' 'https://api.twitter.com/oauth2/token'
curl --request GET --url https://api.twitter.com/1.1/account_activity/all/subscriptions/count.json --header 'authorization: Bearer TOKEN'
## [HubSpot API 密钥](https://developers.hubspot.com/docs/methods/owners/get_owners)
获取所有所有者：```
https://api.hubapi.com/owners/v2/owners?hapikey={keyhere}
获取所有联系方式：``` https://api.hubapi.com/contacts/v1/lists/all/contacts/all?hapikey={keyhere}
## [Infura API 密钥](https://docs.infura.io/infura/networks/ethereum/how-to/secure-a-project/project-id)```
curl https://mainnet.infura.io/v3/<YOUR-API-KEY> -X POST -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"eth_accounts","params":[],"id":1}'
curl https://www.deviantart.com/oauth2/token -d grant_type=client_credentials -d client_id=ID_HERE -d client_secret=mysecret
## [Deviant Art 访问令牌](https://www.deviantart.com/developers/authentication)```
curl https://www.deviantart.com/api/v1/oauth2/placebo -d access_token=Alph4num3r1ct0k3nv4lu3
curl -X GET https://app.pendo.io/api/v1/feature -H 'content-type: application/json' -H 'x-pendo-integration-key:KEY_HERE' curl -X GET https://app.pendo.io/api/v1/metadata/schema/account -H 'content-type: application/json' -H 'x-pendo-integration-key:KEY_HERE'
## [SendGrid API 令牌](https://docs.sendgrid.com/api-reference)```
curl -X "GET" "https://api.sendgrid.com/v3/scopes" -H "Authorization: Bearer SENDGRID_TOKEN-HERE" -H "Content-Type: application/json"
检测：
应用ID/客户端密钥： sq0[a-z]{3}-[0-9A-Za-z\-_]{22,43}
认证令牌： EAAA[a-zA-Z0-9]{60}
测试应用ID和客户端密钥：``` curl "https://squareup.com/oauth2/revoke" -d '{"access_token":"[RANDOM_STRING]","client_id":"[APP_ID]"}' -H "Content-Type: application/json" -H "Authorization: Client [CLIENT_SECRET]"
指示有效凭据的响应：```
empty
返回表示凭证无效的响应：``` { "message": "Not Authorized", "type": "service.not_authorized" }
**测试认证令牌：**```
curl https://connect.squareup.com/v2/locations -H "Authorization: Bearer [AUHT_TOKEN]"
指示有效凭据的响应：``` {"locations":[{"id":"CBASELqoYPXr7RtT-9BRMlxGpfcgAQ","name":"Coffee \u0026 Toffee SF","address":{"address_line_1":"1455 Market Street","locality":"San Francisco","administrative_district_level_1":"CA","postal_code":"94103","country":"US"},"timezone":"America/Los_Angeles"........
响应指示无效凭据：```
{"errors":[{"category":"AUTHENTICATION_ERROR","code":"UNAUTHORIZED","detail":"This request could not be authorized."}]}
curl -v https://cdn.contentful.com/spaces/SPACE_ID_HERE/entries\?access_token\=ACCESS_TOKEN_HERE
## [Dropbox API](https://www.dropbox.com/developers/documentation/http/documentation)```
curl -X POST https://api.dropboxapi.com/2/users/get_current_account --header "Authorization: Bearer TOKEN_HERE"
安装 awscli，将访问密钥和秘密密钥设置为环境变量，然后执行以下命令：``` AWS_ACCESS_KEY_ID=xxxx AWS_SECRET_ACCESS_KEY=yyyy aws sts get-caller-identity
可以使用 [Enumerate-IAM](https://github.com/andresriancho/enumerate-iam) 来确定 AWS 凭证的权限。这提供了更广泛的已发现AWS凭证权限视图，而不仅仅是检查S3存储桶。```
git clone https://github.com/andresriancho/enumerate-iam
cd enumerate-iam
./enumerate-iam.py --access-key AKIA... --secret-key StF0q...
--url https://api.lokalise.com/api2/projects/
--header 'x-api-token: [API-KEY-HERE]'
## [MailGun 私钥](https://documentation.mailgun.com/en/latest/api_reference.html)```
curl --user 'api:YOUR_API_KEY' "https://api.mailgun.net/v3/domains"
curl -v -u [email protected]:test -X GET 'https://domain.freshdesk.com/api/v2/groups/1' This requires the API key in '[email protected]', pass in 'test' and 'domain.freshdesk.com' to be the instance url of the target. In case you get a 403, try the endpoint api/v2/tickets, which is accessible for all keys.
## [JumpCloud API 密钥](https://docs.jumpcloud.com/1.0/authentication-and-authorization/authentication-and-authorization-overview)
#### [v1](https://docs.jumpcloud.com/1.0/systemusers)```
List systems:
curl -H "x-api-key: APIKEYHERE" "https://console.jumpcloud.com/api/systems"
curl -H "x-api-key: APIKEYHERE" "https://console.jumpcloud.com/api/systemusers"
curl -H "x-api-key: APIKEYHERE" "https://console.jumpcloud.com/api/applications"
List systems:
curl -X GET https://console.jumpcloud.com/api/v2/systems/{System_ID}/memberof
-H 'Accept: application/json'
-H 'Content-Type: application/json'
-H 'x-api-key: {API_KEY}'
## Microsoft Azure 租户
格式：```
CLIENT_ID: [0-9a-z\-]{36}
CLIENT_SECRET: [0-9A-Za-z\+\=]{40,50}
TENANT_ID: [0-9a-z\-]{36}
验证:``` curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d 'client_id=<CLIENT_ID>&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default&client_secret=<CLIENT_SECRET>&grant_type=client_credentials' 'https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token'
## [微软共享访问签名 (SAS)](https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/storage/common/storage-dotnet-shared-access-signature-part-1.md)
以下PowerShell可用于测试共享访问签名令牌：```powershell
static void UseAccountSAS(string sasToken)
{
// Create new storage credentials using the SAS token.
StorageCredentials accountSAS = new StorageCredentials(sasToken);
// Use these credentials and the account name to create a Blob service client.
CloudStorageAccount accountWithSAS = new CloudStorageAccount(accountSAS, "account-name", endpointSuffix: null, useHttps: true);
CloudBlobClient blobClientWithSAS = accountWithSAS.CreateCloudBlobClient();
// Now set the service properties for the Blob client created with the SAS.
blobClientWithSAS.SetServiceProperties(new ServiceProperties()
{
HourMetrics = new MetricsProperties()
{
MetricsLevel = MetricsLevel.ServiceAndApi,
RetentionDays = 7,
Version = "1.0"
},
MinuteMetrics = new MetricsProperties()
{
MetricsLevel = MetricsLevel.ServiceAndApi,
RetentionDays = 7,
Version = "1.0"
},
Logging = new LoggingProperties()
{
LoggingOperations = LoggingOperations.All,
RetentionDays = 14,
Version = "1.0"
}
});
// The permissions granted by the account SAS also permit you to retrieve service properties.
ServiceProperties serviceProperties = blobClientWithSAS.GetServiceProperties();
Console.WriteLine(serviceProperties.HourMetrics.MetricsLevel);
Console.WriteLine(serviceProperties.HourMetrics.RetentionDays);
Console.WriteLine(serviceProperties.HourMetrics.Version);
}
如果以下命令返回 Summary or Text is required.，则表示该 URL 有效。如果返回 Invalid webhook URL 或任何其他响应，则意味着该 URL 无效。```
curl -H "Content-Type:application/json" -d "{'text':''}" "YOUR_WEBHOOK_URL"
## [New Relic 个人 API 密钥 (NerdGraph)](https://docs.newrelic.com/docs/apis/nerdgraph/get-started/introduction-new-relic-nerdgraph#endpoint)```
curl -X POST https://api.newrelic.com/graphql \
-H 'Content-Type: application/json' \
-H 'API-Key: YOUR_API_KEY' \
-d '{ "query": "{ requestContext { userId apiKey } }" } '
curl -X GET 'https://api.newrelic.com/v2/applications.json'
-H "X-Api-Key:${APIKEY}" -i
如果有效，进一步测试它是否为[管理员密钥](https://docs.newrelic.com/docs/apis/get-started/intro-apis/types-new-relic-api-keys#admin)
## [Heroku API 密钥](https://devcenter.heroku.com/articles/platform-api-quickstart)```
curl -X POST https://api.heroku.com/apps -H "Accept: application/vnd.heroku+json; version=3" -H "Authorization: Bearer API_KEY_HERE"
Mapbox 秘密密钥以 sk 开头，其余密钥以 pk（公共令牌）、sk（秘密令牌）或 tk（临时令牌）开头。```
curl "https://api.mapbox.com/geocoding/v5/mapbox.places/Los%20Angeles.json?access_token=ACCESS_TOKEN"
#Check token validity curl "https://api.mapbox.com/tokens/v2?access_token=YOUR_MAPBOX_ACCESS_TOKEN"
#Get list of all tokens associated with an account. (only works if the token is a Secret Token (sk), and has the appropiate scope) curl "https://api.mapbox.com/tokens/v2/MAPBOX_USERNAME_HERE?access_token=YOUR_MAPBOX_ACCESS_TOKEN"
## [Salesforce API 密钥](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart_oauth.htm)```
curl https://instance_name.salesforce.com/services/data/v20.0/ -H 'Authorization: Bearer access_token_here'
如果密钥具有listIndexes权限，你可以列出索引：```
curl --request GET
--url https://-1.algolianet.com/1/indexes/
--header 'content-type: application/json'
--header 'x-algolia-api-key: '
--header 'x-algolia-application-id: '
否则，你将需要知道索引的名称（请检查应用程序源代码或其发出的请求）。然后枚举其内容：```
curl --request GET \
--url https://<example-app-id>-1.algolianet.com/1/indexes/<example-index> \
--header 'content-type: application/json' \
--header 'x-algolia-api-key: <example-key>' \
--header 'x-algolia-application-id: <example-appid>'
运行此命令时需谨慎，因为有效载荷可能会在管理环境中执行，具体取决于你正在编辑哪个索引的 highlightPreTag。建议使用更隐蔽的有效载荷（例如 XSS Hunter）来证明可能的跨站脚本攻击。```
curl --request PUT
--url https://-1.algolianet.com/1/indexes//settings
--header 'content-type: application/json'
--header 'x-algolia-api-key: '
--header 'x-algolia-application-id: '
--data '{"highlightPreTag": ""}'
## [Zapier Webhook Token](https://zapier.com/help/how-get-started-webhooks-zapier/)```
curl -H "Accept: application/json" -H "Content-Type: application/json" -X POST -d '{"name":"streaak"}' "webhook_url_here"
curl -H "Accept: application/vnd.pagerduty+json;version=2" -H "Authorization: Token token=TOKEN_HERE" -X GET "https://api.pagerduty.com/schedules"
## [BrowserStack Access Key](https://www.browserstack.com/automate/rest-api)```
curl -u "USERNAME:ACCESS_KEY" https://api.browserstack.com/automate/plan.json
每个服务的密钥限制不同。测试密钥时，如果密钥在一个服务上受限/未激活，请尝试使用其他服务。
*定价单位为每1000次请求的美元（前10万次请求内）
更多信息可在此处获取：
https://github.com/ozguralp/gmapsapiscanner/
https://developers.google.com/maps/api-key-best-practices
向以下 URL 发送 POST 请求：``` https://www.google.com/recaptcha/api/siteverify
`secret` 和 `response` 是两个必需的 POST 参数，其中 `secret` 是密钥，`response` 是待验证的响应。
正则表达式：`^6[0-9a-zA-Z_-]{39}$`。API 密钥始终以 6 开头，长度为 40 个字符。在此处了解更多：https://developers.google.com/recaptcha/docs/verify。
## [Google Cloud 服务账号凭据](https://cloud.google.com/docs/authentication/production)
服务账号凭据可能出现在如下的 JSON 文件中：```
$ cat service_account.json
{
"type": "service_account",
"project_id": "...",
"private_key_id": "...",
"private_key": "-----BEGIN PRIVATE KEY-----...-----END PRIVATE KEY-----\n",
"client_email": "...",
"client_id": "...",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/..."
}
如果是这种情况，你可以使用 gcloud 工具检查这些凭据（如何安装 gcloud）：```
$ gcloud auth activate-service-account --key-file=service_account.json
Activated service account credentials for: [...]
$ gcloud auth print-access-token
ya29.c...
在成功的情况下，你会在终端中看到打印的访问令牌。请注意，在确认凭据确实有效后，你可能需要枚举这些凭据的权限，这属于另一个话题。
## [Branch.IO 密钥与 Secret](https://docs.branch.io/pages/apps/deep-linking-api/#app-read)
请访问以下链接以检查有效性：```
https://api2.branch.io/v1/app/KEY_HERE?branch_secret=SECRET_HERE
访问此链接以检查密钥的有效性。有效密钥的响应应以 authenticationResultCode: "ValidCredentials" 开头。```
https://dev.virtualearth.net/REST/v1/Locations?CountryRegion=US&adminDistrict=WA&locality=Somewhere&postalCode=98001&addressLine=100%20Main%20St.&key=API_KEY
## [Bit.ly 访问令牌](https://dev.bitly.com/authentication.html)
访问以下URL以检查有效性：```
https://api-ssl.bitly.com/v3/shorten?access_token=ACCESS_TOKEN&longUrl=https://www.google.com
curl -H "Authorization: Bearer ACCESS_TOKEN"
https://api.buildkite.com/v2/access-token
## [ButterCMS-API-Key](https://buttercms.com/docs/api/#authentication)```
curl -X GET 'https://api.buttercms.com/v2/posts/?auth_token=your_api_token'
curl -H "Authorization: Bearer ACCESS_TOKEN" https://app.asana.com/api/1.0/users/me
## [Zendesk 访问令牌](https://support.zendesk.com/hc/en-us/articles/203663836-Using-OAuth-authentication-with-your-application)```
curl https://{subdomain}.zendesk.com/api/v2/tickets.json \
-H "Authorization: Bearer ACCESS_TOKEN"
API 令牌与 OAuth 令牌不同，API 令牌是 Support 管理界面中自动生成的密码。``` curl https://{target}.zendesk.com/api/v2/users.json \ -u support@{target}.com/token:{here your token}
## [MailChimp API 密钥](https://developer.mailchimp.com/documentation/mailchimp/reference/overview/)```
curl --request GET --url 'https://<dc>.api.mailchimp.com/3.0/' --user 'anystring:<API_KEY>' --include
此问题可通过查看 @hateshape 的 gist https://gist.github.com/hateshape/2e671ea71d7c243fac7ebf51fb738f0a 进一步利用。``` curl "https://api.wpengine.com/1.2/?method=site&account_name=ACCOUNT_NAME&wpe_apikey=WPENGINE_APIKEY"
## [DataDog API key](https://docs.datadoghq.com/api/)```
curl "https://api.datadoghq.com/api/v1/dashboard?api_key=<api_key>&application_key=<application_key>"
不要删除末尾的`：````
curl https://api.delighted.com/v1/metrics.json
-H "Content-Type: application/json"
-u YOUR_DELIGHTED_API_KEY:
## [Travis CI API token](https://developer.travis-ci.com/gettingstarted)```
curl -H "Travis-API-Version: 3" -H "Authorization: token <TOKEN>" https://api.travis-ci.org/repos
curl https://api.telegram.org/bot/getMe
## [WakaTime API 密钥](https://wakatime.com/developers)```
curl "https://wakatime.com/api/v1/users/current?api_key=KEY_HERE"
curl -u : "https://sonarcloud.io/api/authentication/validate"
## [Spotify 访问令牌](https://developer.spotify.com/documentation/general/guides/authorization-guide/)```
curl -H "Authorization: Bearer <ACCESS_TOKEN>" https://api.spotify.com/v1/me
例如：IGQVJ...``` curl -X GET 'https://graph.instagram.com/{user-id}?fields=id,username&access_token={access-token}'
## [Instagram 图谱 API 访问令牌](https://developers.facebook.com/docs/instagram-api/getting-started)
例如：EAAJjmJ...```
curl -i -X GET 'https://graph.facebook.com/v8.0/me/accounts?access_token={access-token}'
curl "https://gitlab.example.com/api/v4/projects?private_token=<your_access_token>"
## [GitLab runner 注册令牌](https://docs.gitlab.com/runner/register/)```
docker run --rm gitlab/gitlab-runner register \
--non-interactive \
--executor "docker" \
--docker-image alpine:latest \
--url "https://gitlab.com/" \
--registration-token "PROJECT_REGISTRATION_TOKEN" \
--description "keyhacks-test" \
--maintenance-note "Testing token with keyhacks" \
--tag-list "docker,aws" \
--run-untagged="true" \
--locked="false" \
--access-level="not_protected"
curl -v https://api.sandbox.paypal.com/v1/oauth2/token
-H "Accept: application/json"
-H "Accept-Language: en_US"
-u "client_id:secret"
-d "grant_type=client_credentials"
该访问令牌可进一步用于从PayPal API中提取数据。更多信息：https://developer.paypal.com/docs/api/overview/#make-rest-api-calls。
可通过以下方式验证：```
curl -v -X GET "https://api.sandbox.paypal.com/v1/identity/oauth2/userinfo?schema=paypalv1.1" -H "Content-Type: application/json" -H "Authorization: Bearer [ACCESS_TOKEN]"
curl https://api.stripe.com/v1/charges -u token_here:
保留标记末尾的冒号，以防止 `cURL` 请求密码。
令牌的格式始终如下：`sk_live_24charshere`，其中 `24charshere` 部分包含 24 个来自 `a-z A-Z 0-9` 的字符。还有一个测试密钥，以 `sk_test` 开头，但此密钥毫无价值，因为仅用于测试目的，并且很可能不包含任何敏感信息。而 live 密钥则可用于提取/检索大量信息——从收费到完整的产品列表。
请注意，你永远无法获得完整的信用卡信息，因为 Stripe 只提供最后 4 位数字。
更多信息/完整文档：https://stripe.com/docs/api/authentication。
## [Razorpay API 密钥和 Secret 密钥](https://razorpay.com/docs/api/)
可以通过以下方式验证：```
curl -u <YOUR_KEY_ID>:<YOUR_KEY_SECRET> \
https://api.razorpay.com/v1/payments
curl https://circleci.com/api/v1.1/me?circle-token=
## [Cloudflare API 密钥](https://api.cloudflare.com/#user-api-tokens-verify-token)```
curl -X GET "https://api.cloudflare.com/client/v4/user/tokens/verify" \
-H "Authorization: Bearer <YOUR_API_TOKEN>"
curl 'http://api.addressy.com/Capture/Interactive/Find/v1.00/json3.ws?Key=<KEY_HERE>&Countries=US,CA&Language=en&Limit=5&Text=BHAR'
## [Ipstack API 密钥](https://ipstack.com/documentation)```
curl 'https://api.ipstack.com/{ip_address}?access_key={keyhere}'
您可以通过使用 npm 验证 NPM 令牌（将 00000000-0000-0000-0000-000000000000 替换为 NPM 令牌）：```
export NPM_TOKEN="00000000-0000-0000-0000-000000000000"
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
npm whoami
另一种验证令牌的方法是直接查询API：```
curl -H 'authorization: Bearer 00000000-0000-0000-0000-000000000000' 'https://registry.npmjs.org/-/whoami'
成功时返回用户名，若令牌不存在则返回 401 Unauthorized，若您的IP地址不在白名单中则返回 403 Forbidden。
NPM令牌可以设置CIDR白名单。因此，如果您使用的令牌来自非白名单的CIDR，则会返回 403 Forbidden。请尝试从不同的IP范围验证NPM令牌！
附注：某些公司使用的注册表并非 registry.npmjs.org。如果是这种情况，请将所有 registry.npmjs.org 替换为公司NPM注册表的域名。
curl https://api.opsgenie.com/v2/alerts -H 'Authorization: GenieKey API_KEY'
## [Keen.io API Key](https://keen.io/docs/api/)
获取特定项目的所有集合：```
curl "https://api.keen.io/3.0/projects/PROJECT_ID/events?api_key=READ_KEY"
注意：在令牌末尾保留冒号，以防止cURL请求密码。 信息：令牌始终采用以下格式：sk_live_34charshere，其中34charshere部分包含34个字符，来自a-z A-Z 0-9。 还有一个测试密钥，以sk_test开头，但这个密钥毫无价值，因为它仅用于测试目的，很可能不包含任何敏感信息。 另一方面，实时密钥可用于提取/检索大量信息。从费用到完整的产品列表。 请记住，你永远无法获取完整的信用卡信息，因为Stripe只会提供类似最后四位的数字。 更多信息/完整文档：https://stripe.com/docs/api/authentication =======
获取用户信息：```` curl --header "X-TOKEN: <your_token>" https://calendly.com/api/v1/users/me
列出 Webhook 订阅：````
curl --header "X-TOKEN: <your_token>" https://calendly.com/api/v1/hooks
获取过去 24 小时内发出的请求总数：``` curl -H "x-api-key: {API_Key}" "https://api.applicationinsights.io/v1/apps/{APP_ID}/metrics/requests/count"
## [Cypress record key](https://docs.cypress.io/guides/dashboard/projects.html#Record-key)
为了检查 `recordKey` 的有效性，你需要 `projectId`，这是一个公共值，通常可以在 `cypress.json` 文件中找到。将 JSON 正文中的 `{recordKey}` 和 `{projectId}` 替换为你的值。```
curl -i -s -k -X $'POST' \
-H $'x-route-version: 4' -H $'x-os-name: darwin' -H $'x-cypress-version: 5.5.0' -H $'host: api.cypress.io' -H $'accept: application/json' -H $'content-type: application/json' -H $'Content-Length: 1433' -H $'Connection: close' \
--data-binary $'{\"ci\":{\"params\":null,\"provider\":null},\"specs\":[\"cypress/integration/examples/actions.spec.js\",\"cypress/integration/examples/aliasing.spec.js\",\"cypress/integration/examples/assertions.spec.js\",\"cypress/integration/examples/connectors.spec.js\",\"cypress/integration/examples/cookies.spec.js\",\"cypress/integration/examples/cypress_api.spec.js\",\"cypress/integration/examples/files.spec.js\",\"cypress/integration/examples/local_storage.spec.js\",\"cypress/integration/examples/location.spec.js\",\"cypress/integration/examples/misc.spec.js\",\"cypress/integration/examples/navigation.spec.js\",\"cypress/integration/examples/network_requests.spec.js\",\"cypress/integration/examples/querying.spec.js\",\"cypress/integration/examples/spies_stubs_clocks.spec.js\",\"cypress/integration/examples/traversal.spec.js\",\"cypress/integration/examples/utilities.spec.js\",\"cypress/integration/examples/viewport.spec.js\",\"cypress/integration/examples/waiting.spec.js\",\"cypress/integration/examples/window.spec.js\"],\"commit\":{\"sha\":null,\"branch\":null,\"authorName\":null,\"authorEmail\":null,\"message\":null,\"remoteOrigin\":null,\"defaultBranch\":null},\"group\":null,\"platform\":{\"osCpus\":[],\"osName\":\"darwin\",\"osMemory\":{\"free\":1153744896,\"total\":17179869184},\"osVersion\":\"19.6.0\",\"browserName\":\"Electron\",\"browserVersion\":\"85.0.4183.121\"},\"parallel\":null,\"ciBuildId\":null,\"projectId\":\"{projectId}\",\"recordKey\":\"{recordKey}\",\"specPattern\":null,\"tags\":[\"\"]}' \
$'https://api.cypress.io/runs'
是的，这个请求确实需要这么大。如果projectId和recordKey都有效，它将返回200 OK以及一些关于运行的信息；如果projectId无效，则返回404 Not Found及{"message":"Project not found. Invalid projectId."}；如果recordKey无效，则返回401 Unauthorized及{"message":"Invalid Record Key."}。
projectId的示例是1yxykz，recordKey的示例是a216e7b4-4819-4713-b9c2-c5da60a1c48c。
获取YouTube频道的内容详情（此示例中的channelId指向PewDiePie的频道）。``` curl -iLk 'https://www.googleapis.com/youtube/v3/activities?part=contentDetails&maxResults=25&channelId=UC-lHJZR3Gqxm24_Vd_AJ5Yw&key={KEY_HERE}'
## [ABTasty API 密钥](https://developers.abtasty.com/server-side.html#authentication)```
curl "api_endpoint_here" -H "x-api-key: your_api_key"
以 JSON 格式导出活动分析数据，每行一条记录。必须使用 'range' 或 'startDateTime' 与 'endDateTime' 之一。``` curl -H "Api_Key: {API_KEY}" https://api.iterable.com/api/export/data.json?dataTypeName=emailSend&range=Today&onlyFields=List.empty
## [Amplitude API 密钥](https://help.amplitude.com/hc/en-us/articles/205406637-Export-API-Export-Your-Project-s-Event-Data)
响应是一个打包的 JSON 文件归档，每小时可能包含多个文件。请注意，2014-11-12 之前的事件将按天分组，而非按小时。如果您请求的时间范围内项目未收集任何数据，则服务器将返回 404 响应。```
curl -u API_Key:Secret_Key 'https://amplitude.com/api/2/export?start=20200201T5&end=20210203T20' >> yourfilename.zip
2. 获取特定项目的最新应用构建信息：
> 使用步骤[1](#438)的响应中获取的`name`和`owner.name`。 ```
curl -sX GET "https://api.appcenter.ms/v0.1/apps/{owner.name}/{name}/releases/latest" \
-H "Content-Type: application/json" \
-H "X-Api-Token: {your_api_token}"
curl -X POST
'https://api.weglot.com/translate?api_key=my_api_key'
-H 'Content-Type: application/json'
-d '{
"l_from":"en",
"l_to":"fr",
"request_url":"https://www.website.com/",
"words":[
{"w":"This is a blue car", "t": 1},
{"w":"This is a black car", "t": 1}
]
}'
## [PivotalTracker API Token](https://www.pivotaltracker.com/help/api/#top)
1. 使用API令牌列出用户信息： ```
curl -X GET -H "X-TrackerToken: $TOKEN" "https://www.pivotaltracker.com/services/v5/me?fields=%3Adefault"
成功的访问令牌请求会返回一个 JSON 对象，包含 access_token、expires_in。``` curl -XPOST -H "Content-type: application/x-www-form-urlencoded" -d 'grant_type=client_credentials&client_id=&client_secret=' 'https://www.linkedin.com/oauth/v2/accessToken'
## [Help Scout OAUTH](https://developer.helpscout.com/mailbox-api/overview/authentication/)
成功的访问令牌请求会返回一个包含 token_type、access_token 和 expires_in 的 JSON 对象。```
curl -X POST https://api.helpscout.net/v2/oauth2/token \
--data "grant_type=client_credentials" \
--data "client_id={application_id}" \
--data "client_secret={application_secret}"
curl "https://api.shodan.io/shodan/host/8.8.8.8?key=TOKEN_HERE"
## [Bazaarvoice Passkey](https://developer.bazaarvoice.com/conversations-api/home)
一个成功的Passkey请求返回一个包含公司名称的JSON对象```
curl 'https://which-cpv-api.bazaarvoice.com/clientInfo?conversationspasskey=<Passkey>' --insecure
Grafana API 支持 Bearer 和 Basic 认证方案。Bearer:``` curl -s -H "Authorization: Bearer your-api-key" http://your-grafana-server-url.com/api/user
基本:```
curl -u username:password http://your-grafana-server-url.com/api/user
欢迎公众贡献。
问题跟踪器是提交错误报告和功能请求的首选渠道。
错误跟踪器使用多种标签来帮助组织和识别问题。
使用 GitHub 问题搜索 — 检查该问题是否已被报告。
本项目仅用于教育和道德测试目的。未经事先双方同意，使用此工具攻击目标是非法的。开发者不承担任何责任，也不对此工具造成的任何滥用或损害负责。
| 名称 | 端点 | 定价 |
|---|