daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/token-spray
History
sandeep 10ecdc806a Additional matcher 2021-10-14 23:43:45 +05:30
..
README.md directory update 2021-10-05 02:30:50 +05:30
asana.yaml tags update 2021-10-05 02:32:57 +05:30
bingmaps.yaml tags update 2021-10-05 02:32:57 +05:30
bitly.yaml tags update 2021-10-05 02:32:57 +05:30
buildkite.yaml tags update 2021-10-05 02:32:57 +05:30
buttercms.yaml tags update 2021-10-05 02:32:57 +05:30
calendly.yaml tags update 2021-10-05 02:32:57 +05:30
circleci.yaml tags update 2021-10-05 02:32:57 +05:30
deviantart.yaml tags update 2021-10-05 02:32:57 +05:30
dropbox.yaml tags update 2021-10-05 02:32:57 +05:30
github.yaml tags update 2021-10-05 02:32:57 +05:30
google-autocomplete.yaml tags update 2021-10-05 02:32:57 +05:30
google-customsearch.yaml tags update 2021-10-05 02:32:57 +05:30
google-directions.yaml tags update 2021-10-05 02:32:57 +05:30
google-elevation.yaml tags update 2021-10-05 02:32:57 +05:30
google-fcm.yaml tags update 2021-10-05 02:32:57 +05:30
google-findplacefromtext.yaml tags update 2021-10-05 02:32:57 +05:30
google-gedistancematrix.yaml tags update 2021-10-05 02:32:57 +05:30
google-geocode.yaml tags update 2021-10-05 02:32:57 +05:30
google-geolocation.yaml tags update 2021-10-05 02:32:57 +05:30
google-mapsembed.yaml tags update 2021-10-05 02:32:57 +05:30
google-mapsembedadvanced.yaml tags update 2021-10-05 02:32:57 +05:30
google-nearbysearch.yaml tags update 2021-10-05 02:32:57 +05:30
google-nearestroads.yaml tags update 2021-10-05 02:32:57 +05:30
google-placedetails.yaml tags update 2021-10-05 02:32:57 +05:30
google-placesphoto.yaml tags update 2021-10-05 02:32:57 +05:30
google-playablelocations.yaml tags update 2021-10-05 02:32:57 +05:30
google-routetotraveled.yaml tags update 2021-10-05 02:32:57 +05:30
google-speedlimit.yaml tags update 2021-10-05 02:32:57 +05:30
google-staticmaps.yaml tags update 2021-10-05 02:32:57 +05:30
google-streetview.yaml tags update 2021-10-05 02:32:57 +05:30
google-timezone.yaml tags update 2021-10-05 02:32:57 +05:30
googlet-extsearchplaces.yaml tags update 2021-10-05 02:32:57 +05:30
heroku.yaml tags update 2021-10-05 02:32:57 +05:30
hubspot.yaml tags update 2021-10-05 02:32:57 +05:30
instagram.yaml tags update 2021-10-05 02:32:57 +05:30
ipstack.yaml tags update 2021-10-05 02:32:57 +05:30
iterable.yaml Additional matcher 2021-10-14 23:43:45 +05:30
jumpcloud.yaml tags update 2021-10-05 02:32:57 +05:30
lokalise.yaml tags update 2021-10-05 02:32:57 +05:30
loqate.yaml tags update 2021-10-05 02:32:57 +05:30
mailchimp.yaml tags update 2021-10-05 02:32:57 +05:30
mailgun.yaml tags update 2021-10-05 02:32:57 +05:30
mapbox.yaml tags update 2021-10-05 02:32:57 +05:30
nerdgraph.yaml tags update 2021-10-05 02:32:57 +05:30
npm.yaml tags update 2021-10-05 02:32:57 +05:30
openweather.yaml tags update 2021-10-05 02:32:57 +05:30
pagerduty.yaml tags update 2021-10-05 02:32:57 +05:30
pendo.yaml tags update 2021-10-05 02:32:57 +05:30
pivotaltracker.yaml tags update 2021-10-05 02:32:57 +05:30
postmark.yaml tags update 2021-10-05 02:32:57 +05:30
sendgrid.yaml tags update 2021-10-05 02:32:57 +05:30
slack.yaml tags update 2021-10-05 02:32:57 +05:30
sonarcloud.yaml tags update 2021-10-05 02:32:57 +05:30
spotify.yaml tags update 2021-10-05 02:32:57 +05:30
square.yaml tags update 2021-10-05 02:32:57 +05:30
stripe.yaml tags update 2021-10-05 02:32:57 +05:30
tinypng.yaml tags update 2021-10-05 02:32:57 +05:30
travisci.yaml tags update 2021-10-05 02:32:57 +05:30
twitter.yaml tags update 2021-10-05 02:32:57 +05:30
visualstudio.yaml tags update 2021-10-05 02:32:57 +05:30
wakatime.yaml tags update 2021-10-05 02:32:57 +05:30
weglot.yaml tags update 2021-10-05 02:32:57 +05:30
youtube.yaml tags update 2021-10-05 02:32:57 +05:30

README.md

About

This directory holds templates that have static API URL endpoints. Use these to test an API token against many API service endpoints. By providing token input using flag, Nuclei will test the token against all known API endpoints within the API templates, and return any successful results. By incorporating API checks as Nuclei Templates, users can test API keys that have no context (i.e., API keys that do not indicate for which API endpoint they are meant).

Usage

You do not need to specify an input URL to test a token against these API endpoints, as the API endpoints have static URLs. However, Nuclei requires an input (specified via -u for individual URLs or -l for a file containing URLs). Because of this requirement, we simply pass in -u "null". Each template in the token-spray directory assumes the input API token will be provided using CLI var flag.

# Run Nuclei specifying all the api templates:

nuclei -u null -t token-spray/ -var token=thisIsMySecretTokenThatIWantToTest

Credits

These API testing templates were inspired by the streaak/keyhacks repository. The Bishop Fox Continuous Attack Surface Testing (CAST) team created additional API templates for testing API keys uncovered during investigations. You are welcome to add new templates based on the existing format to cover more APIs.