I usually don't pay for my premium access to special web services. Instead i hijack API keys and related info. You'd be surprised how sloppy devs are when it comes to getting rid of their actual tokens and such before they commit a project to github or post something on pastebin or the like.
The trick is to know how the dev has to refer to the tokens depending on the supported langs of course. Consider the following.
// File: index.js
// [...]
let pusher = new Pusher({
appId: 'PUSHER_APP_ID',
key: 'PUSHER_APP_KEY',
secret: 'PUSHER_APP_SECRET',
cluster: 'PUSHER_APP_CLUSTER',
useTLS: true
});
Pusher is the service i am trying to hijack api keys for. The above is a block of JS. So when a dev wants to use the Pusher API he has to have something resembling this code block in his source together with his API keys in order for the web resource to accept it.
If i know this i can just use advanced Google search terms to see if someone got sloppy. In this case i'd probably do something along the lines of:
intext:("pusher|appId:|key:|secret:|cluster:") site:pastebin.com
// or
intext:("pusher|appId:|key:|secret:|cluster:") site:github.com filetype:javascript
More often than not you get lucky, plus it's very easy to automate this process to harvest leaked API keys and secrets on an industrial scale.
Anyone use similar techniques to find API keys? And while we're on the subject i need an API key for VirusTotal and a premium one for Shodan. I hijacked like 5 low level ones, which severely limits the amount of times i can request certain things through the Shodan API.
