<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-api-key-exposure-testing
description: >-
  Detect exposed API keys, secrets, and tokens in client-side code,
  public repositories, HTTP responses, JavaScript files, mobile app
  bundles, and configuration endpoints that enable unauthorized API
  access and data exfiltration.
domain: cybersecurity
subdomain: application-security
tags:
  - api-key
  - secrets
  - exposure
  - client-side
  - owasp-a02
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1552.001", "T1552.004"]
  owasp-top10: ["A02"]
  tools: ["gitleaks", "trufflehog", "nuclei", "curl", "jsluice"]
---

# Performing API Key Exposure Testing

## Overview

API keys and secrets exposed in client-side code, public repositories, and
HTTP responses provide attackers with unauthorized access to third-party
services, cloud infrastructure, and internal APIs. Testing identifies
exposed credentials across all accessible attack surfaces before attackers
find them.

## Prerequisites

- Tools: gitleaks, trufflehog, nuclei, curl, jsluice
- Target web application URLs
- Access to JavaScript bundles and API responses

## Workflow

### Step 1: Client-Side JavaScript Analysis

```bash
# Extract JavaScript file URLs
curl -s https://target.com/ | grep -oE 'src="[^"]*\.js"' | \
  sed 's/src="//;s/"//'

# Search JS files for API keys
for js in $(curl -s https://target.com/ | grep -oE 'src="[^"]*\.js"' | \
  sed 's/src="//;s/"//'); do
  echo "--- $js ---"
  curl -s "https://target.com$js" | grep -oEi \
    '(api[_-]?key|apikey|secret|token|password|auth)["\'\s]*[:=]["\'\s]*[a-zA-Z0-9_\-]{16,}'
done

# jsluice for structured JS secret extraction
jsluice urls -R https://target.com/app.js
jsluice secrets https://target.com/app.js
```

### Step 2: HTTP Response Analysis

```bash
# Check common config/debug endpoints
for path in /api/config /config.json /env /.env /debug /info \
  /actuator/env /api/settings; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com$path")
  if [ "$code" = "200" ]; then
    echo "[EXPOSED] https://target.com$path"
    curl -s "https://target.com$path" | head -20
  fi
done

# Check for keys in response headers
curl -s -D- https://target.com/api/ | grep -iE \
  'x-api-key|authorization|x-secret|x-token'
```

### Step 3: Repository Scanning

```bash
# Gitleaks scan
gitleaks detect --source=. --report-format=json --report-path=secrets.json

# Trufflehog scan git history
trufflehog git file://. --json --only-verified

# Search for common key patterns
rg -n 'AKIA[0-9A-Z]{16}' .  # AWS Access Keys
rg -n 'sk-[a-zA-Z0-9]{32,}' .  # OpenAI / Stripe keys
rg -n 'ghp_[a-zA-Z0-9]{36}' .  # GitHub tokens
rg -n 'xoxb-[0-9]' .  # Slack tokens
```

### Step 4: Validate Exposed Keys

```bash
# Test AWS key validity
aws sts get-caller-identity --no-cli-pager 2>&1

# Test OpenAI key
curl -s -H "Authorization: Bearer sk-EXPOSED_KEY" \
  https://api.openai.com/v1/models | jq .error

# Test GitHub token
curl -s -H "Authorization: token ghp_EXPOSED" \
  https://api.github.com/user | jq .login

# Nuclei exposed token templates
nuclei -u https://target.com -t http/exposures/tokens/ -json
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Key patterns in JS files | Content scanning | Regex match for known key formats |
| Config endpoint accessible | HTTP monitoring | 200 response on debug/config paths |
| Git history secrets | Pre-commit hooks | gitleaks in CI/CD pipeline |

```yaml
title: Api Key Exposure Testing Detection
id: c3d3ef09-288d-44ed-8cc9-d4b096a57dc9
status: experimental
description: Detects suspicious activity related to performing api key exposure testing techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1552.001
  - attack.t1552.004
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All JavaScript bundles scanned for embedded keys
- [ ] Config and debug endpoints tested for exposure
- [ ] Repository history scanned for leaked secrets
- [ ] Exposed keys validated for active access
- [ ] Rotation initiated for any confirmed exposures
- [ ] Client-side code uses proxy pattern instead of direct API keys

## References

- [Gitleaks](https://github.com/gitleaks/gitleaks)
- [TruffleHog](https://github.com/trufflesecurity/trufflehog)
- [OWASP API Security Top 10](https://owasp.org/API-Security/)
- [KeyHacks](https://github.com/streaak/keyhacks)
