hacktricks-cloud/src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md

GCP - API Keys Enum

{{#include ../../../banners/hacktricks-training.md}}

Basic Information

Katika Google Cloud Platform (GCP), API keys ni mfuatano rahisi wa encrypted ambao unatambulisha programu bila principal yoyote. Zinatumika kufikia Google Cloud APIs ambazo hazihitaji muktadha wa mtumiaji. Hii ina maana kwamba mara nyingi zinatumika katika hali ambapo programu inapata data yake mwenyewe badala ya data za mtumiaji.

Restrictions

Unaweza kueka vizuizi kwa API keys kwa ajili ya usalama ulioimarishwa. Kwa mfano, unaweza kuzuia funguo kutumika tu na anwani fulani za IP, tovuti, programu za android, programu za iOS, au kuzuia kwa APIs au huduma fulani ndani ya GCP.

Enumeration

Inawezekana kuona vizuizi vya API key (ikiwemo vizuizi vya GCP API endpoints) kwa kutumia orodha ya vitenzi au kuelezea:

gcloud services api-keys list
gcloud services api-keys describe <key-uuid>
gcloud services api-keys list --show-deleted

Note

Inawezekana kurejesha funguo zilizofutwa kabla ya siku 30 kupita, ndiyo maana unaweza kuorodhesha funguo zilizofutwa.

Privilege Escalation & Post Exploitation

{{#ref}} ../gcp-privilege-escalation/gcp-apikeys-privesc.md {{#endref}}

Unauthenticated Enum

{{#ref}} ../gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md {{#endref}}

Persistence

{{#ref}} ../gcp-persistence/gcp-api-keys-persistence.md {{#endref}}

{{#include ../../../banners/hacktricks-training.md}}