Apikey Pentest

API Key Penetration Testing Skill

Targeted penetration testing focused on buyer platform and seller platform API key security.

When to Activate

• Testing API key exposure in buyer/seller platforms
• Auditing code repositories for leaked secrets
• Fuzzing API endpoints to discover hidden parameters
• Intercepting and analyzing API traffic
• Validating API key access control and scoping

Attack Playbook

Execute phases in order. Record every finding immediately.

Phase 1: Code-Level Secret Scanning

Scan the entire codebase and git history for leaked API keys, tokens, and credentials.

1A. Gitleaks (Git History Scan)

# Scan full git history for secrets
gitleaks detect --source=<REPO_PATH> --report-format=json --report-path=gitleaks-report.json -v

# Scan specific branch
gitleaks detect --source=<REPO_PATH> --branch=<BRANCH> --report-format=json --report-path=gitleaks-branch-report.json -v

1B. TruffleHog (Deep Secret Scan)

# Scan local filesystem
trufflehog filesystem <REPO_PATH> --json > trufflehog-report.json

# Scan git repo with full history
trufflehog git file://<REPO_PATH> --json > trufflehog-git-report.json

1C. Manual Pattern Grep

# API key patterns
grep -rn "api[_-]?key\s*[:=]" <REPO_PATH> --include="*.py" --include="*.js" --include="*.ts" --include="*.env" --include="*.yaml" --include="*.yml" --include="*.json" --include="*.toml"

# Bearer tokens
grep -rn "Bearer\s\+" <REPO_PATH> --include="*.py" --include="*.js"

# Common secret patterns
grep -rn "SECRET\|PASSWORD\|TOKEN\|PRIVATE_KEY\|AWS_ACCESS\|sk-\|pk_\|rk_" <REPO_PATH> --include="*.py" --include="*.env*" --include="*.yaml"

# .env files that should not be committed
find <REPO_PATH> -name ".env" -o -name ".env.*" -not -name ".env.example" | head -20

Phase 2: Buyer Platform API Key Testing

2A. Identify Buyer API Endpoints

# Grep for buyer-related API routes
grep -rn "buyer\|purchase\|order\|cart\|checkout\|payment" <REPO_PATH> --include="*.py" --include="*.js" -l

# Find API route definitions
grep -rn "@app\.route\|@router\.\|path(\|url(" <REPO_PATH> --include="*.py" -l

2B. Test Buyer API Key Permissions

For each buyer API key found, test:

• Can it access seller-only endpoints? (privilege escalation)
• Can it access other buyers' data? (IDOR)
• Does it work without proper authentication headers?
• Is rate limiting enforced?
• Does the key expire properly?

2C. Endpoint Fuzzing (ffuf)

# Fuzz for hidden buyer API endpoints
ffuf -w <WORDLIST> -u <BASE_URL>/api/buyer/FUZZ -H "Authorization: Bearer <API_KEY>" -mc 200,201,301,302,403

# Parameter fuzzing
ffuf -w <WORDLIST> -u "<BASE_URL>/api/buyer/endpoint?FUZZ=value" -H "Authorization: Bearer <API_KEY>" -mc 200

Phase 3: Seller Platform API Key Testing

3A. Identify Seller API Endpoints

# Grep for seller-related API routes
grep -rn "seller\|vendor\|merchant\|product\|listing\|inventory\|shop" <REPO_PATH> --include="*.py" --include="*.js" -l

# Find seller API key usage
grep -rn "seller.*key\|merchant.*key\|vendor.*api" <REPO_PATH> --include="*.py"

3B. Test Seller API Key Permissions

For each seller API key found, test:

• Can it access buyer data? (privilege escalation)
• Can it access other sellers' data? (IDOR)
• Can it modify products of other sellers?
• Can it access admin endpoints?
• Is the key properly scoped to the seller's resources?

3C. Cross-Platform Key Testing

# Try buyer key on seller endpoints
curl -H "Authorization: Bearer <BUYER_KEY>" <BASE_URL>/api/seller/products

# Try seller key on buyer endpoints
curl -H "Authorization: Bearer <SELLER_KEY>" <BASE_URL>/api/buyer/orders

# Try key without any auth
curl <BASE_URL>/api/seller/products
curl <BASE_URL>/api/buyer/orders

Phase 4: API Key Lifecycle Testing

# Test expired keys
curl -H "Authorization: Bearer <EXPIRED_KEY>" <BASE_URL>/api/endpoint

# Test revoked keys
curl -H "Authorization: Bearer <REVOKED_KEY>" <BASE_URL>/api/endpoint

# Test malformed keys
curl -H "Authorization: Bearer invalidkey123" <BASE_URL>/api/endpoint
curl -H "Authorization: Bearer " <BASE_URL>/api/endpoint
curl -H "Authorization: " <BASE_URL>/api/endpoint

# Key rotation: does old key still work after rotation?

Phase 5: Traffic Interception Analysis

# Capture API traffic (if app is running locally)
mitmproxy -p 8080 --set console_eventlog_verbosity=debug

# Check if API keys are transmitted in URL (bad practice)
grep -rn "api_key=\|apikey=\|key=" <REPO_PATH> --include="*.py" --include="*.js"

# Check if HTTPS is enforced
grep -rn "http://" <REPO_PATH> --include="*.py" --include="*.js" --include="*.env"

Finding Report Template

For each finding, record:

### [SEVERITY] Finding Title

- **Category**: Secret Leak / Privilege Escalation / IDOR / Missing Auth / Weak Key
- **Severity**: CRITICAL / HIGH / MEDIUM / LOW
- **Location**: file:line or endpoint URL
- **Description**: What was found
- **Evidence**: Command output or code snippet
- **Impact**: What an attacker could do
- **Recommendation**: How to fix

Severity Classification

Output Files

All scan results saved to the project's docs/security/ directory:

• gitleaks-report.json — git secret scan results
• trufflehog-report.json — deep secret scan results
• apikey-pentest-findings.md — human-readable findings report
• buyer-api-test.md — buyer platform test results
• seller-api-test.md — seller platform test results