id: pinata-api-key

info:
  name: Pinata API Key - Expose
  author: 0xpugal
  severity: info
  classification:
    cwe-id: CWE-540
  tags: pinata,exposure,api-keys,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: false
    matchers:
      - type: word
        words:
          - "pinata_api_key"
          - "pinata_api_secret"
          - "pinataKey"
          - "pinataSecret"
          - "pinata-key"
          - "pinata_secret"
        case-insensitive: true
        condition: or

    extractors:
      - type: regex
        part: body
        regex:
          - (?i)pinata[_\-.]?(?:api[_\-.]?)?key\s*[:=]\s*['"]?([A-Za-z0-9_\-]+)['"]?
          - (?i)pinata[_\-.]?(?:api[_\-.]?)?secret\s*[:=]\s*['"]?([A-Za-z0-9_\-]+)['"]?
          - (?i)PINATA[_\-.]?(?:API[_\-.]?)?KEY\s*=\s*['"]?([A-Za-z0-9_\-]+)['"]?
          - (?i)PINATA[_\-.]?(?:API[_\-.]?)?SECRET\s*=\s*['"]?([A-Za-z0-9_\-]+)['"]?
          - (?i)pinata(?:[_\-. ]|)(?:api|Api|API|)?(?:[_\-. ]|)(?:key|Key)\s*[:=]\s*['"]?([A-Za-z0-9_\-]+)['"]?
          - (?i)pinata(?:[_\-. ]|)(?:api|Api|API|)?(?:[_\-. ]|)(?:secret|Secret)\s*[:=]\s*['"]?([A-Za-z0-9_\-]+)['"]?
          - (?i)"?pinata[_\-.]?(?:api[_\-.]?)?key\"?\s*[:]\s*\"([A-Za-z0-9_\-]+)\"
          - (?i)"?pinata[_\-.]?(?:api[_\-.]?)?secret\"?\s*[:]\s*\"([A-Za-z0-9_\-]+)\"
          - (?i)(?:const|let|var)?\s*pinata[_\-.]?(?:api[_\-.]?)?key\s*=\s*['"]([A-Za-z0-9_\-]+)['"]
          - (?i)(?:const|let|var)?\s*pinata[_\-.]?(?:api[_\-.]?)?secret\s*=\s*['"]([A-Za-z0-9_\-]+)['"]
          - (?i)pinata[^A-Za-z0-9]{0,8}([A-Za-z0-9_\-]{16,128})
# digest: 4b0a00483046022100fafea1eda647e4c305da02005131101e9c220b321c4c056cbd5b3bd4c075c066022100af961f4fefe69a101f2f537b0df36027048d84508fa4e3f20d12bda697d44d2a:922c64590222798bb761d5b6d8e72950