mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-15 06:13:16 -08:00
79 lines
4.6 KiB
Markdown
79 lines
4.6 KiB
Markdown
# GCP - API Keys Unauthenticated Enum
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## API Keys
|
|
|
|
For more information about API Keys check:
|
|
|
|
{% content-ref url="../gcp-services/gcp-api-keys-enum.md" %}
|
|
[gcp-api-keys-enum.md](../gcp-services/gcp-api-keys-enum.md)
|
|
{% endcontent-ref %}
|
|
|
|
### OSINT techniques
|
|
|
|
**Google API Keys are widely used by any kind of applications** that uses from the client side. It's common to find them in for websites source code or network requests, in mobile applications or just searching for regexes in platforms like Github.
|
|
|
|
The regex is: **`AIza[0-9A-Za-z_-]{35}`**
|
|
|
|
Search it for example in Github following: [https://github.com/search?q=%2FAIza%5B0-9A-Za-z\_-%5D%7B35%7D%2F\&type=code\&ref=advsearch](https://github.com/search?q=%2FAIza%5B0-9A-Za-z_-%5D%7B35%7D%2F\&type=code\&ref=advsearch)
|
|
|
|
### Check origin GCP project - `apikeys.keys.lookup`
|
|
|
|
This is extremely useful to check to **which GCP project an API key that you have found belongs to**:
|
|
|
|
```bash
|
|
# If you have permissions
|
|
gcloud services api-keys lookup AIzaSyD[...]uE8Y
|
|
name: projects/5[...]6/locations/global/keys/28d[...]e0e
|
|
parent: projects/5[...]6/locations/global
|
|
|
|
# If you don't, you can still see the project ID in the error msg
|
|
gcloud services api-keys lookup AIzaSy[...]Qbkd_oYE
|
|
ERROR: (gcloud.services.api-keys.lookup) PERMISSION_DENIED: Permission 'apikeys.keys.lookup' denied on resource project.
|
|
Help Token: ARD_zUaNgNilGTg9oYUnMhfa3foMvL7qspRpBJ-YZog8RLbTjCTBolt_WjQQ3myTaOqu4VnPc5IbA6JrQN83CkGH6nNLum6wS4j1HF_7HiCUBHVN
|
|
- '@type': type.googleapis.com/google.rpc.PreconditionFailure
|
|
violations:
|
|
- subject: ?error_code=110002&service=cloudresourcemanager.googleapis.com&permission=serviceusage.apiKeys.getProjectForKey&resource=projects/89123452509
|
|
type: googleapis.com
|
|
- '@type': type.googleapis.com/google.rpc.ErrorInfo
|
|
domain: apikeys.googleapis.com
|
|
metadata:
|
|
permission: serviceusage.apiKeys.getProjectForKey
|
|
resource: projects/89123452509
|
|
service: cloudresourcemanager.googleapis.com
|
|
reason: AUTH_PERMISSION_DENIED
|
|
```
|
|
|
|
### Brute Force API endspoints
|
|
|
|
As you might not know which APIs are enabled in the project, it would be interesting to run the tool [https://github.com/ozguralp/gmapsapiscanner](https://github.com/ozguralp/gmapsapiscanner) and check **what you can access with the API key.**
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|