gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['', 'src/pentesting-cloud/gcp-security/gcp-unauthenticated-e

Browse Source
This commit is contained in:
Translator
2026-06-16 13:40:19 +00:00
parent 7c52cb5d5a
commit adacca642e
1 changed files with 101 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md
+101 -10
View File
@@ -12,19 +12,19 @@ Kwa maelezo zaidi kuhusu API Keys angalia:
### OSINT techniques
**Google API Keys zinatumika sana na aina yoyote ya programu** zinazotumia kutoka upande wa mteja. Ni kawaida kuzipata katika msimbo wa chanzo wa tovuti au maombi ya mtandao, katika programu za simu au tu kutafuta regex katika majukwaa kama Github.
**Google API Keys hutumiwa sana na aina yoyote ya applications** zinazotumia kutoka upande wa client. Ni kawaida kuzipata kwenye source code za websites au network requests, kwenye mobile applications, au kwa kutafuta tu regexes kwenye platforms kama Github.
Regex ni: **`AIza[0-9A-Za-z_-]{35}`**
Tafuta kwa mfano katika Github ikifuatia: [https://github.com/search?q=%2FAIza%5B0-9A-Za-z\_-%5D%7B35%7D%2F\&type=code\&ref=advsearch](https://github.com/search?q=%2FAIza%5B0-9A-Za-z_-%5D%7B35%7D%2F&type=code&ref=advsearch)
Itafute kwa mfano kwenye Github kupitia: [https://github.com/search?q=%2FAIza%5B0-9A-Za-z\_-%5D%7B35%7D%2F\&type=code\&ref=advsearch](https://github.com/search?q=%2FAIza%5B0-9A-Za-z_-%5D%7B35%7D%2F&type=code&ref=advsearch)
### Check origin GCP project
Hii ni muhimu sana kuangalia **ni mradi gani wa GCP ambao API key uliyopata inahusiana nao**. Tuna chaguzi tofauti:
Hii ni muhimu sana kuangalia **API key uliyopata inahusiana na GCP project gani**. Tuna chaguzi tofauti:
- Wasiliana na `https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=<api-key`
- Contact `https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=<api-key>`
Kwa ajili ya ufupi, matokeo yalikatwa, lakini katika matokeo kamili ID ya mradi inaonekana zaidi ya mara 5.
Kwa ajili ya ufupi output ilikatwa, lakini kwenye output kamili project ID inaonekana zaidi ya mara 5
```bash
curl -s "https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=AIzaSyD[...]uE8Y"
@@ -34,9 +34,9 @@ curl -s "https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectCo
"message": "Identity Toolkit API has not been used in project 943955951114 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=943955951114 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
[...]
```
- Wasiliana na `https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=<api-key>`
- Wasiliana na `https://identitytoolkit.googleapis.com/v1/projects?key=<api-key>`
Kwa ajili ya ufupi, matokeo yalikatwa, lakini katika matokeo kamili, kitambulisho cha mradi kinaonekana zaidi ya mara 5.
Kwa ajili ya ufupi, output ilipunguzwa, lakini katika output kamili project ID inaonekana zaidi ya mara 5
```bash
curl -s "https://identitytoolkit.googleapis.com/v1/projects?key=AIzaSyD[...]uE8Y"
@@ -46,7 +46,7 @@ curl -s "https://identitytoolkit.googleapis.com/v1/projects?key=AIzaSyD[...]uE8Y
"message": "Identity Toolkit API has not been used in project 943955951114 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=943955951114 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
[...]
```
- [Hii sasa haitumiki tena!] `apikeys.keys.lookup`
- [Hii haifanyi kazi tena!] `apikeys.keys.lookup`
```bash
# If you have permissions
gcloud services api-keys lookup AIzaSyD[...]uE8Y
@@ -69,8 +69,99 @@ resource: projects/89123452509
service: cloudresourcemanager.googleapis.com
reason: AUTH_PERMISSION_DENIED
```
### Brute Force API endspoints
### Discovery-document driven API recon
Kama hujui ni APIs zipi zimewezeshwa katika mradi, itakuwa ya kuvutia kutumia chombo [https://github.com/ozguralp/gmapsapiscanner](https://github.com/ozguralp/gmapsapiscanner) na kuangalia **kila kitu unachoweza kufikia kwa kutumia API key.**
Once you have a valid key, don't just test the obvious public APIs. In Google environments, **discovery documents** can work as a machine-readable attack-surface map exposing **resources, methods, paths, HTTP verbs, parameters, and request/response schemas**.
Useful targets:
```bash
# Public / common path
curl -s 'https://serviceusage.googleapis.com/$discovery/rest?key=<api-key>'
# Hidden docs behind a visibility label
curl -s 'https://serviceusage.googleapis.com/$discovery/rest?labels=GOOGLE_INTERNAL&key=<api-key>'
```
Kumbuka:
- Linganisha ukubwa wa document na idadi ya method zikiwa na na bila labels kama `GOOGLE_INTERNAL`.
- A **true nonexistent method** kwa kawaida hurudisha **HTML 404**. **JSON 404** yenye `Method not found.` inaweza kuonyesha kwamba method ipo lakini **API key project inakosa visibility label inayohitajika**.
- Baadhi ya first-party APIs ni rahisi kufikia kupitia `*.clients6.google.com` au undocumented `*-pa.googleapis.com` hosts kuliko kupitia public API explorer.
Hii ni hasa muhimu kuorodhesha **internal/admin APIs zilizofichuliwa kimakosa kwenye Internet** na kujenga custom fuzzers kutoka schema badala ya kubahatisha JSON fields manually.
### Key ownership filtering at scale
Ukikusanya Google API keys nyingi kutoka APKs, browser traffic, IPAs au binaries, unaweza kutaka kutambua haraka **project ipi inamiliki kila key** na kama inahusiana na target company.
Trick ya vitendo ni kuita kwa makusudi API ambayo **haijaenabled** kwa key. Google mara nyingi hufichua **project number** inayounga mkono katika error:
```bash
curl -s 'https://protos.googleapis.com/$discovery/rest?key=<api-key>'
```
Tafuta ujumbe kama:
```text
Protos API has not been used in project 244648151629 before or it is disabled
```
Namba hiyo ya project inaweza kisha kuhusishwa na endpoints nyingine, leaked metadata, au internal company-mapping logic ili kutenganisha **in-scope first-party keys** kutoka kwa customer / third-party projects.
### Handle key restrictions before discarding a key
Key iliyowekewa restriction si lazima iwe haina faida. Hifadhi context ambako key ilipatikana na replay requests kwa matching headers:
```bash
# Browser restricted
curl -H 'X-Goog-Api-Key: <api-key>' \
-H 'Referer: https://target.google.com' \
'https://servicemanagement.googleapis.com/v1/operations'
# iOS restricted
curl -H 'X-Goog-Api-Key: <api-key>' \
-H 'X-Ios-Bundle-Identifier: com.google.GoogleMobile' \
'https://servicemanagement.clients6.google.com/v1/operations'
# Android restricted
curl -H 'X-Goog-Api-Key: <api-key>' \
-H 'X-Android-Package: com.google.android.settings.intelligence' \
-H 'X-Android-Cert: <sha1-signing-cert>' \
'https://servicemanagement.clients6.google.com/v1/operations'
```
Common restriction classes:
- **HTTP Referer**
- **iOS bundle ID** (`X-Ios-Bundle-Identifier`)
- **Android package + signing cert** (`X-Android-Package` + `X-Android-Cert`)
- **Server IP** restrictions, which generally cannot be bypassed remotely
### First-party auth / origin whitelist hints
Some Google web APIs accept a mix of **session cookie + first-party authorization headers** and are hosted on `*.clients6.google.com`. When testing these APIs:
- Keep `Origin` and `Referer` compatible with the product that normally uses the API.
- A `401` with `reason: SESSION_COOKIE_INVALID` can actually mean the **origin is not whitelisted**, not that the cookie is bad.
- Publicly reachable APIs that only accept internal origins such as `*.corp.google.com` are high-value candidates for broken access control review.
### Brute force enabled APIs and fuzz documented methods
As you might not know which APIs are enabled in the project, it would be interesting to run the tool [https://github.com/ozguralp/gmapsapiscanner](https://github.com/ozguralp/gmapsapiscanner) and check **what you can access with the API key.**
After you identify reachable services, prefer **schema-driven fuzzing** over blind guessing:
- Generate requests directly from discovery docs
- Replay the same request with **all known working keys**
- Normalize errors so you can distinguish **invalid input** from **visibility-label / auth / restriction** failures
- For numeric object identifiers, try nearby values such as `ID-1`, `ID+1`, `1`, `2`, `100`, `1000`
- Only report when you confirm **cross-user data access** or another real authorization failure; plain enumeration is usually not enough by itself
### Common vuln pattern: unauthenticated direct-object reference
A recurring bug pattern is an **internal/admin API** that accepts a victim-controlled identifier (for example `gaiaId`) and only validates that the request carries a usable API key, but **never checks whether the caller is authorized to access that specific object**.
```bash
curl 'https://gfibervoice-pa.googleapis.com/v1/BssGetVoiceSettings?gaiaId=<victim_gaia_id>' \
-H 'X-Goog-Api-Key: <api-key>'
```
If the endpoint returns another user's phone number, email address, settings, or other private fields, treat it as a classic **IDOR / broken access control** issue.
## Marejeo
- [Hacking Google with AI: AI-Assisted Discovery-Document Fuzzing of Google APIs](https://brutecat.com/articles/hacking-google-with-ai)
- [Google APIs Explorer](https://developers.google.com/apis-explorer)
{{#include ../../../banners/hacktricks-training.md}}