apikey-pentest

name	apikey-pentest
description	API Key penetration testing skill for buyer/seller platform API key security assessment. Runs secret scanning (trufflehog + gitleaks), endpoint fuzzing (ffuf + arjun), traffic analysis, and records all findings.
origin	custom

API Key Penetration Testing Skill

Targeted penetration testing focused on buyer platform and seller platform API key security.

When to Activate

• Testing API key exposure in buyer/seller platforms
• Auditing code repositories for leaked secrets
• Fuzzing API endpoints to discover hidden parameters
• Intercepting and analyzing API traffic
• Validating API key access control and scoping

Attack Playbook

Execute phases in order. Record every finding immediately.

Phase 1: Code-Level Secret Scanning

Scan the entire codebase and git history for leaked API keys, tokens, and credentials.

1A. Gitleaks (Git History Scan)

# Scan full git history for secrets
gitleaks detect --source=<REPO_PATH> --report-format=json --report-path=gitleaks-report.json -v

# Scan specific branch
gitleaks detect --source=<REPO_PATH> --branch=<BRANCH> --report-format=json --report-path=gitleaks-branch-report.json -v

1B. TruffleHog (Deep Secret Scan)

# Scan local filesystem
trufflehog filesystem <REPO_PATH> --json > trufflehog-report.json

# Scan git repo with full history
trufflehog git file://<REPO_PATH> --json > trufflehog-git-report.json

1C. Manual Pattern Grep

# API key patterns
grep -rn "api[_-]?key\s*[:=]" <REPO_PATH> --include="*.py" --include="*.js" --include="*.ts" --include="*.env" --include="*.yaml" --include="*.yml" --include="*.json" --include="*.toml"

# Bearer tokens
grep -rn "Bearer\s\+" <REPO_PATH> --include="*.py" --include="*.js"

# Common secret patterns
grep -rn "SECRET\|PASSWORD\|TOKEN\|PRIVATE_KEY\|AWS_ACCESS\|sk-\|pk_\|rk_" <REPO_PATH> --include="*.py" --include="*.env*" --include="*.yaml"

# .env files that should not be committed
find <REPO_PATH> -name ".env" -o -name ".env.*" -not -name ".env.example" | head -20

Phase 2: Buyer Platform API Key Testing

2A. Identify Buyer API Endpoints

# Grep for buyer-related API routes
grep -rn "buyer\|purchase\|order\|cart\|checkout\|payment" <REPO_PATH> --include="*.py" --include="*.js" -l

# Find API route definitions
grep -rn "@app\.route\|@router\.\|path(\|url(" <REPO_PATH> --include="*.py" -l

2B. Test Buyer API Key Permissions

For each buyer API key found, test:

• Can it access seller-only endpoints? (privilege escalation)
• Can it access other buyers' data? (IDOR)
• Does it work without proper authentication headers?
• Is rate limiting enforced?
• Does the key expire properly?

2C. Endpoint Fuzzing (ffuf)

# Fuzz for hidden buyer API endpoints
ffuf -w <WORDLIST> -u <BASE_URL>/api/buyer/FUZZ -H "Authorization: Bearer <API_KEY>" -mc 200,201,301,302,403

# Parameter fuzzing
ffuf -w <WORDLIST> -u "<BASE_URL>/api/buyer/endpoint?FUZZ=value" -H "Authorization: Bearer <API_KEY>" -mc 200

Phase 3: Seller Platform API Key Testing

3A. Identify Seller API Endpoints

# Grep for seller-related API routes
grep -rn "seller\|vendor\|merchant\|product\|listing\|inventory\|shop" <REPO_PATH> --include="*.py" --include="*.js" -l

# Find seller API key usage
grep -rn "seller.*key\|merchant.*key\|vendor.*api" <REPO_PATH> --include="*.py"

3B. Test Seller API Key Permissions

For each seller API key found, test:

• Can it access buyer data? (privilege escalation)
• Can it access other sellers' data? (IDOR)
• Can it modify products of other sellers?
• Can it access admin endpoints?
• Is the key properly scoped to the seller's resources?

3C. Cross-Platform Key Testing

# Try buyer key on seller endpoints
curl -H "Authorization: Bearer <BUYER_KEY>" <BASE_URL>/api/seller/products

# Try seller key on buyer endpoints
curl -H "Authorization: Bearer <SELLER_KEY>" <BASE_URL>/api/buyer/orders

# Try key without any auth
curl <BASE_URL>/api/seller/products
curl <BASE_URL>/api/buyer/orders

Phase 4: API Key Lifecycle Testing

# Test expired keys
curl -H "Authorization: Bearer <EXPIRED_KEY>" <BASE_URL>/api/endpoint

# Test revoked keys
curl -H "Authorization: Bearer <REVOKED_KEY>" <BASE_URL>/api/endpoint

# Test malformed keys
curl -H "Authorization: Bearer invalidkey123" <BASE_URL>/api/endpoint
curl -H "Authorization: Bearer " <BASE_URL>/api/endpoint
curl -H "Authorization: " <BASE_URL>/api/endpoint

# Key rotation: does old key still work after rotation?

Phase 5: Traffic Interception Analysis

# Capture API traffic (if app is running locally)
mitmproxy -p 8080 --set console_eventlog_verbosity=debug

# Check if API keys are transmitted in URL (bad practice)
grep -rn "api_key=\|apikey=\|key=" <REPO_PATH> --include="*.py" --include="*.js"

# Check if HTTPS is enforced
grep -rn "http://" <REPO_PATH> --include="*.py" --include="*.js" --include="*.env"

Finding Report Template

For each finding, record:

### [SEVERITY] Finding Title

- **Category**: Secret Leak / Privilege Escalation / IDOR / Missing Auth / Weak Key
- **Severity**: CRITICAL / HIGH / MEDIUM / LOW
- **Location**: file:line or endpoint URL
- **Description**: What was found
- **Evidence**: Command output or code snippet
- **Impact**: What an attacker could do
- **Recommendation**: How to fix

Severity Classification

Severity	Criteria
CRITICAL	API key hardcoded in code, key grants admin access, no auth on sensitive endpoint
HIGH	Key in git history, cross-platform privilege escalation, IDOR via API key
MEDIUM	Key not properly scoped, no rate limiting, key doesn't expire
LOW	Key in URL params, verbose error leaking key info, weak key format

Output Files

All scan results saved to the project's docs/security/ directory:

• gitleaks-report.json — git secret scan results
• trufflehog-report.json — deep secret scan results
• apikey-pentest-findings.md — human-readable findings report
• buyer-api-test.md — buyer platform test results
• seller-api-test.md — seller platform test results