BlackAPI

Mapping what others miss. Human error is my favorite.

BlackAPI is a high-efficiency API vulnerability scanner designed to identify misconfigurations and unrestricted permissions in leaked API keys. Built for speed and clarity, it helps security researchers determine the actual impact of a discovered credential.

---

🚀 Features

• Multi-Service Probing: Automatically tests keys against critical infrastructure endpoints.
• Bulk Processing: Supports scanning a single key or importing a wordlist for large-scale reconnaissance.
• Permission Mapping: Specifically identifies if a key is "Unrestricted" or "Accessible" for:
  • Google Maps / Places: Potential for financial drain via unauthorized location queries.
  • YouTube Data: Access to private metadata and video statistics.
  • Firebase Auth: Risks involving unauthorized user registration and database interaction.
• Zero Dependencies: Lightweight Bash script requiring only curl.

---

🛠️ Installation

1. Clone or Download the script to your local machine (Kali Linux/Debian recommended).
2. Grant execution permissions:

   chmod +x blackapi.sh

3. (Optional) Install globally:

   sudo mv blackapi.sh /usr/local/bin/blackapi

---

📖 Usage

Scan a Single Key

Quickly verify the impact of one API key:

./blackapi.sh -k AIzaSyBxxxxxxxxxxxxxx

Scan from a File

Provide a list of keys (one per line) for batch processing:

./blackapi.sh -f api_keys_leak.txt

Help Menu

View all available options:

./blackapi.sh --help

---

🖥️ Console Output Example

When a critical vulnerability is detected, BlackAPI highlights the risk in Green:

[*] PROBING KEY: AIzaSyA-ExampleKey123
[+] Google Maps API: UNRESTRICTED
[+] YouTube Data API: ACCESSIBLE
------------------------------------------------------------
[*] PROBING KEY: AIzaSyB-ExampleKey456
[-] No critical vulnerabilities detected.

---

👨‍💻 Development Credits

• Hacker: Jake Lo
• Assistant: Gemini
• Framework: BlackPentest Environment

---

⚖️ Disclaimer

This tool is intended for authorized penetration testing and educational purposes only. Unauthorized use of this tool against targets without prior written consent is illegal. The developers assume no liability and are not responsible for any misuse or damage caused by this program.