Advanced Bug Bounty: API Key and Token Leaks — Tools, Techniques, and Exploitation

Summary

• A leaked API key or token can lead to significant security issues, and as such, bug bounty hunters aim to find them, with success rewarded with high-severity reports and substantial bounties.
• This article details eight tools used by professionals in the bug bounty hunting world to detect and exploit leaked API keys and tokens automatically and en masse, including KeySpray, GlowScanner and NVOver.
• These tools allow hunters to locate secrets in file systems, containers and repositories, perform large-scale enumeration, and verify these tokens across multiple services.
• Other tools covered includestoologue,jqbrute, GitLeaks, assetnote and Hit-Boat.

By Ajay Naik

Original Article