inurl:"/wp-json/wp/v2/users"
intitle:"index.of" intext:"api.txt"
inurl:"/api/v1" intext:"index of /"
ext:php inurl:"api.php?action="
intitle:"index of" api_key OR "api key" OR apiKey -pool
Git Dorking
filename:swagger.json
extension: .json
Search GitHub for your target organization’s name paired with potentially sensitive types of information, such as “api key,” "api keys", "apikey", "key", "authorization: Bearer", "access_token", "secret", or “token.”
TruffleHog
TruffleHog can also be used to search for secrets in other sources like Git, Gitlab, Amazon S3, filesystem, and Syslog.
$ sudo docker run -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --org=target-name
Wayback Machine
Finding and comparing historical snapshots of API documentation can simplify testing for Improper Assets Management.
$ kr scan HTTP://target.com -w ~/api/wordlists/data/kiterunner/routes-large.kite
# With a wordlist
$ kr brute <target> -w ~/api/wordlists/data/automated/nameofwordlist.txt
Run with authorization header
$ kr scan http://192.168.50.35:8090 -w ~/api/wordlists/data/kiterunner/routes-large.kite -H
'x-access-token: eyJhb<-SNIP->zFk'
This scan will result in identifying the following endpoints:
GET 200 [ 217, 1, 1] http://192.168.50.35:8090/api/user/info
GET 200 [ 101471, 1871, 1] http://192.168.50.35:8090/api/pictures/
GET 200 [ 217, 1, 1] http://192.168.50.35:8090/api/user/info/
GET 200 [ 101471, 1871, 1] http://192.168.50.35:8090/api/pictures
GraphQL endpoint
Detect the Programming Language
Header X-Powered-By:
PHP/x.x.x – the API is written in PHP
ASP.NET – the API is written in C#
Express – this API is written in NodeJS
Next.js – this API is written in NodeJS for use with the React framework
PleskLin – this API was written in PHP
Other headers:
Server – this header will occasionally contain information about the server software being used. For example, Microsoft-IIS/x.x or nginx.
X-AspNet-Version – this header will be present if the API is written in ASP.NET and can help you determine which version is being used.
X-AspNetMvc-Version – this header is present when an API is written in ASP.NET MVC.
Set-Cookie – while it’s not a guarantee, some languages have distinct cookie patterns that may give away what technology is in use. For example, ASP.NET_SessionId, JSESSIONID or PHPSESSID
X-Runtime – this header is often used in Ruby on Rails applications and can give you a good indication that the API is written in Ruby.
