一些提取api key的正则表达式

jiangmingzi

分享几十条提取api key的正则表达式。可以借助burp、Mitmproxy，goproxy等来实现敏感信息的发现。
在实际使用过程中，因为有部分规则是有转义的，在整合进工具的时候需要检查下，修正后使用即可。也欢迎大家回复本文补充新的～

1. "aliyun_oss_url": "[\\w-.]\\.oss.aliyuncs.com"
   
2. "azure_storage": "https?://[\\w-\.]\\.file.core.windows.net"
   
3. "access_key": "[Aa](ccess|CCESS)_?[Kk](ey|EY)|[Aa](ccess|CCESS)_?[sS](ecret|ECRET)|[Aa](ccess|CCESS)_?(id|ID|Id)"
   
4. "secret_key": "[Ss](ecret|ECRET)_?[Kk](ey|EY)"
   
5. "slack_token": "(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})"
   
6. <!-- more -->
   
7. 
   
8. "slack_webhook": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}"
   
9. "facebook_oauth": "[f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K].{0,30}['"\\s][0-9a-f]{32}['"\\s]",
   
10. "twitter_oauth": "[t|T][w|W][i|I][t|T][t|T][e|E][r|R].{0,30}['"\\s][0-9a-zA-Z]{35,44}['"\\s]"
    
11. "heroku_api": "[h|H][e|E][r|R][o|O][k|K][u|U].{0,30}[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}"
    
12. "mailgun_api": "key-[0-9a-zA-Z]{32}"
    
13. "mailchamp_api": "[0-9a-f]{32}-us[0-9]{1,2}"
    
14. "picatic_api": "sk_live_[0-9a-z]{32}"
    
15. "google_oauth_id": "[0-9(+-[0-9A-Za-z_]{32}.apps.qooqleusercontent.com"
    
16. "google_api": "AIza[0-9A-Za-z-_]{35}"
    
17. "google_captcha": "6L[0-9A-Za-z-_]{38}"
    
18. "google_oauth": "ya29\\.[0-9A-Za-z\\-_]+"
    
19. "amazon_aws_access_key_id": "AKIA[0-9A-Z]{16}"
    
20. "amazon_mws_auth_token": "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
    
21. "amazonaws_url": "s3\\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\\.s3\\.amazonaws.com"
    
22. "facebook_access_token": "EAACEdEose0cBA[0-9A-Za-z]+"
    
23. "mailgun_api_key": "key-[0-9a-zA-Z]{32}"
    
24. "twilio_api_key": "SK[0-9a-fA-F]{32}"
    
25. "twilio_account_sid": "AC[a-zA-Z0-9_\\-]{32}"
    
26. "twilio_app_sid": "AP[a-zA-Z0-9_\\-]{32}"
    
27. "paypal_braintree_access_token": "access_token\\$production\\$[0-9a-z]{16}\\$[0-9a-f]{32}"
    
28. "square_oauth_secret": "sq0csp-[ 0-9A-Za-z\\-_]{43}"
    
29. "square_access_token": "sqOatp-[0-9A-Za-z\\-_]{22}"
    
30. "stripe_standard_api": "sk_live_[0-9a-zA-Z]{24}"
    
31. "stripe_restricted_api": "rk_live_[0-9a-zA-Z]{24}"
    
32. "github_access_token": "[a-zA-Z0-9_-]*:[a-zA-Z0-9_\\-]+@github\\.com*"
    
33. "private_ssh_key": "-----BEGIN PRIVATE KEY-----[a-zA-Z0-9\\S]{100,}-----END PRIVATE KEY——"
    
34. "private_rsa_key": "-----BEGIN RSA PRIVATE KEY-----[a-zA-Z0-9\\S]{100,}-----END RSA PRIVATE KEY-----"
    

复制代码

1. 本文作者： BaCde
   
2. 本文链接： https://bacde.me/post/Extract-API-Keys-From-Regex/
   
3. 版权声明： 本博客所有文章除特别声明外，均采用 BY-NC-SA 许可协议。转载请注明出处！

复制代码