id: google-api-key

info:
  name: Google API Key
  author: Swissky
  severity: info
  reference:
    - https://cloud.google.com/docs/authentication/api-keys#securing
    - https://support.google.com/googleapi/answer/6310037
  metadata:
    max-request: 2
  tags: exposure,token,google,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/hopfully404"

    extractors:
      - type: regex
        part: body
        regex:
          - "AIza[0-9A-Za-z\\-_]{35}"
# digest: 4a0a00473045022100d690d16050855b7da8890848e083d831a442b80020b43688497d752321c901730220261dc35b09bac35251ba9eb94d5a83327a45f0f6a2dbe8884225ce2fb07c3e79:922c64590222798bb761d5b6d8e72950