Some of the results are web servers leaking the private keys of the website or in some cases mail servers.
Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
11–20 of 60 posts
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#12The wonders of the "Googledork". There is a lot of information out there which definitely shouldn't be public: https://www.exploit-db.com/google-hacking-database/
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#13I am definitely making this a part of regular security scan.
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#14Slightly related question about API keys that rely on referer (say Google Vision) - what stops me using curl to spoof referer and rake in thousands in someone’s bill (15 cents per 1k recognitions)? I assume there’s some IP based quota, but I haven’t seen a knob for that on GCP at least.
This should be enforced on your server and you shouldn’t have clients directly connecting to a service like Google Vision. I have a system that uses AWS lambda so that I don’t have to distribute my 3rd party API keys but I still have to add rate limiting.
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#15I was a little surprised to see an Apple domain in there, but I can't really tell what the private key was for (could have been a test or an example). It looks like it's either an outdated result or an Apple engineer quickly saw this and fixed it because the page 404s now.
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#16Can someone explain why the inurl:server is used? Wouldn't this also work without that (and reveal more results where the keyfile has been renamed)
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#17Slightly related question about API keys that rely on referer (say Google Vision) - what stops me using curl to spoof referer and rake in thousands in someone’s bill (15 cents per 1k recognitions)? I assume there’s some IP based quota, but I haven’t seen a knob for that on GCP at least.
typically APIs can implement rate limits at various levels. Your IP may get throttled when they see it trip over an individual referrers quota.
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#18that yields just 7 pages (10 items each) so it's probably pretty irrelevant.
but of course you are welcome to share your run of the mill anecdotes about some intern once accidentally publishing passwords - etc. :)
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#19Can someone explain why the inurl:server is used? Wouldn't this also work without that (and reveal more results where the keyfile has been renamed)
I'm curious also as i'm getting 5x the amount of results excluding the inurl name filter
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#20Can someone explain why the inurl:server is used? Wouldn't this also work without that (and reveal more results where the keyfile has been renamed)
More results does not necessarily mean better results. They probably got more specific to remove references to documentation and such.
Another interesting thing about google is that this search may return results that are not found without the inurl:server