Skip to content

Latest commit

 

History

History
55 lines (42 loc) · 2.18 KB

README.md

File metadata and controls

55 lines (42 loc) · 2.18 KB
Raw

Google Maps API security test automation

Determining whether a leaked Google Maps API Key ( often found in index.html/index.php) files is vulnerable to unauthorized access by other applications or not.

How to the code:

  • Clone the repository using the below command on terminal
https://github.com/vikpande/googleapi-security-automation.git
  • Change directory to the right folder
cd googleapi-security-automation
  • Open the code in sublime/vscode/pycharm and run the below code/file
python3 maps_api_scanner_python3.py

  • When prompted on the terminal, paste API key that u want to test 7 press enter

  • The automation script will return API key is vulnerable for XXX API! message and the PoC link/code if determines any unauthorized access within this API key within any API's.

The code checks for the below GoogleAPI's vulnerabilities:

  • Staticmap API
  • Streetview API
  • Embed (Basic-Free) API
  • Embed (Advanced-Paid) API
  • Directions API
  • Geocode API
  • Distance Matrix API
  • Find Place From Text API
  • Autocomplete API
  • Elevation API
  • Timezone API
  • Roads API

Google API key security best practices

To-do :

  • Automate JavaScript API vulnerability test

Notes:

  • The JavaScript API is not checked by the code because JavaScript API needs manual confirmation from a web browser directly.
  • Reference : https://developers.google.com/maps/documentation/javascript/tutorial URL & copying HTML code and changing 'key' parameter with the one wanted to test.
  • After opening file on the browser, if loaded without errors, then the API key is also vulnerable for JavaScript API.
  • For Staticmap, Streetview and Embed API's, if used from another domain instead of just testing from browser; whether referer checks are enabled or not on the server-side for the key, script still could return it as vulnerable due to a server-side vulnerability.

Contributions:

  • If you find other Google Maps API's which are not mentioned in this script, please create a new branch, commit your code and send a pull request explaining improvements and benefits.