mapbox-api-audit/main.py at main · rivsec/mapbox-api-audit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
import requests
import sys


def check_endpoint(name, url, verbose=False):
    try:
        r = requests.get(url, timeout=10)
        if r.status_code == 200:
            print(f"[+] {name}: OK (HTTP {r.status_code})")
            # Print result in json format only if verbose
            if verbose:
                print(r.json())
        elif r.status_code == 403:
            print(f"[-] {name}: Forbidden (HTTP 403) — likely restricted")
        elif r.status_code == 401:
            print(f"[-] {name}: Unauthorized (HTTP 401) — invalid or revoked token")
        else:
            print(f"[?] {name}: Unexpected status {r.status_code}")
    except requests.RequestException as e:
        print(f"[!] {name}: Request failed: {e}")


def main():
    if len(sys.argv) < 3 or len(sys.argv) > 4:
        print(f"Usage: {sys.argv[0]} <mapbox_public_token> <username> [--verbose]")
        sys.exit(1)

    verbose = "--verbose" in sys.argv
    token = sys.argv[1]
    username = sys.argv[2]
    username = sys.argv[2]

    # 1) Styles API
    styles_url = f"https://api.mapbox.com/styles/v1/{username}?access_token={token}"
    check_endpoint("Styles API", styles_url, verbose)

    # 2) Static Images API
    static_url = f"https://api.mapbox.com/styles/v1/mapbox/streets-v12/static/0,0,1/64x64?access_token={token}"
    check_endpoint("Static Images API", static_url, verbose)

    # 3) Directions API
    directions_url = (
        f"https://api.mapbox.com/directions/v5/mapbox/driving/"
        f"13.38886,52.51703;13.397634,52.529407"
        f"?overview=false&geometries=geojson&access_token={token}"
    )
    check_endpoint("Directions API", directions_url, verbose)

    # 4) Tiles API
    tiles_url = f"https://api.mapbox.com/v4/mapbox.mapbox-streets-v8/tilejson.json?secure&access_token={token}"
    check_endpoint("Tiles API", tiles_url, verbose)

    # 5) Geocoding API
    geocoding_url = f"https://api.mapbox.com/geocoding/v5/mapbox.places/Los%20Angeles.json?access_token={token}"
    check_endpoint("Geocoding API", geocoding_url, verbose)

    # 6) Matrix API
    matrix_url = f"https://api.mapbox.com/directions-matrix/v1/mapbox/driving/13.38886,52.51703;13.397634,52.529407?access_token={token}"
    check_endpoint("Matrix API", matrix_url, verbose)

    # 7) Map Matching API
    matching_url = f"https://api.mapbox.com/matching/v5/mapbox/driving/13.38886,52.51703;13.397634,52.529407?access_token={token}"
    check_endpoint("Map Matching API", matching_url, verbose)

    # 8) Isochrones API
    isochrones_url = f"https://api.mapbox.com/isochrone/v1/mapbox/driving/13.38886,52.51703?contours_minutes=5,10&polygons=true&access_token={token}"
    check_endpoint("Isochrones API", isochrones_url, verbose)

    # 9) Optimization API
    optimization_url = f"https://api.mapbox.com/optimized-trips/v1/mapbox/driving/13.38886,52.51703;13.397634,52.529407?access_token={token}"
    check_endpoint("Optimization API", optimization_url, verbose)

    # 10) Uploads API
    uploads_url = f"https://api.mapbox.com/uploads/v1/{username}?access_token={token}"
    check_endpoint("Uploads API", uploads_url, verbose)

    # 11) Datasets API
    datasets_url = f"https://api.mapbox.com/datasets/v1/{username}?access_token={token}"
    check_endpoint("Datasets API", datasets_url, verbose)

    # 12) Tilesets API
    tilesets_url = f"https://api.mapbox.com/tilesets/v1/{username}?access_token={token}"
    check_endpoint("Tilesets API", tilesets_url, verbose)

    # 13) Accounts API
    accounts_url = f"https://api.mapbox.com/accounts/v1/{username}?access_token={token}"
    check_endpoint("Accounts API", accounts_url, verbose)

    # 14) Tokens API
    tokens_url = f"https://api.mapbox.com/tokens/v2/{username}?access_token={token}"
    check_endpoint("Tokens API", tokens_url, verbose)

    # 15) Rate Limits API
    rate_limits_url = (
        f"https://api.mapbox.com/rate-limits/v1/{username}?access_token={token}"
    )
    check_endpoint("Rate Limits API", rate_limits_url, verbose)


if __name__ == "__main__":
    main()