Description

The endpoints module does a great job capturing various endpoints, but it doesn't go into detail on what HTTP methods are supported.

The API Gateway service allows for the method, url, and API keys to be retrieved. I mirrored a lot of the logic from the endpoints module, but wanted to format the loot as a curl command.

At a high level, this module should allow for API Gateways to be tested more efficiently. I think the endpoints functionality should be kept, where this module extends the existing functionality.

Details

I wrote this a few months back and finally had a chance to test it out.

The module enumerates all of the API gateways along with if they have a custom domain name. It grabs the API keys, which use a hardcoded header of X-Api-Key, and associates them with any stages where they are used.

The loot file generates a curl command with the method, endpoint, and API key if needed. If the request is a POST, DELETE, PATCH, or PUT, the content-type is set to application/json and the data that is sent is an empty json blob. I figure this is a decent starting point, but users will need to try to figure out what a legitimate request body looks like.

API Gateways can define that ANY method can be used on the endpoint. This isn't a standard HTTP verb, so to simplify things for users, I split it into a GET and POST request. This could be expanded to cover the rest of common methods if needed.

The API key is a nice add-in that allows authenticated access to the endpoints, where IAM Get* permissions are more likely to be found in an audit account.

I found this to be a nice way to test accounts with hundreds++ of endpoints. Similar to some of the other loot files, users should be able to append to the curl syntax as needed (Ex: -k for cert validation).

It's been a few months since I wrote it, so feel free to request updates if I missed some styling changes. Let me know if there is more functionality that you would add.