62 lines
1.9 KiB
Markdown
62 lines
1.9 KiB
Markdown
|
|
||
|
|
## Website Links
|
||
|
|
|
||
|
|
In general, searching for links containing "api" word in the search page will sometimes bring up interesting links.
|
||
|
|
|
||
|
|
It can also be suitable to inspect network requests in inspector mode and tying to find some API links.
|
||
|
|
|
||
|
|
|
||
|
|
## Subdomains
|
||
|
|
|
||
|
|
An other way of finding API can be by enumerating some domains. You might find some interecting element. (This can expose some subdomain use for api without containing the specific word "API")
|
||
|
|
|
||
|
|
Enumeration ---> [[Red Team/3 - Web Hacking/1 - Brute Force/2 - Fuzz/• Gobuster]]
|
||
|
|
|
||
|
|
|
||
|
|
## Google dorking
|
||
|
|
|
||
|
|
```
|
||
|
|
intitle:"api" site:"Target.com"
|
||
|
|
intitle:json site:target.com
|
||
|
|
```
|
||
|
|
|
||
|
|
```
|
||
|
|
inurl:"/api/v1" site:"Target.com" ---> Change v1, v2 and v3
|
||
|
|
```
|
||
|
|
|
||
|
|
More information about Google Dorking ---> [[Red Team/Others/OSINT/Dorking/• Google Dorking]]
|
||
|
|
|
||
|
|
|
||
|
|
## Git dorking (Github)
|
||
|
|
|
||
|
|
Sometime, entreprise post there code on github. It might be a good thing to search there. To make some relevent search, simply search in the search bar of github "TARGET API"
|
||
|
|
|
||
|
|
After taking a look around, you can check the issue tab in github. There might be some issue reported about some keys leaks that are still vulnerable.
|
||
|
|
|
||
|
|
![[Pasted image 20221122173136.png]]
|
||
|
|
|
||
|
|
Dorking
|
||
|
|
```
|
||
|
|
extension:json(OR OTHER EXTENSION) TARGET ---> In github searchbar
|
||
|
|
|
||
|
|
"authorization:Bearer" TARGET ---> More information
|
||
|
|
filename:swagger.json TARGET ---> More information
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
## Shodan
|
||
|
|
To search on shodan, simply search your target name in the searchbar
|
||
|
|
|
||
|
|
you can also search by content type
|
||
|
|
```
|
||
|
|
"content-type: application/json" ---> Will give you some application running json
|
||
|
|
|
||
|
|
"wp-json" ---> Of Target is running wordpress (API)
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
## WayBackMachine
|
||
|
|
Allow you to check older version of website. This might leak some old links that can give you access to specific elements.
|
||
|
|
|
||
|
|
|