Finding and exploiting secrets

•

A 3 step process to finding and reporting critical secrets : 🧵👇

1️⃣ Find secrets : ➡ Look into source control like Github, gitlab etc Use github dorks for more directed searches. Like github.com/techgaun/github-dorks/blob/master/github-dorks.txt

➡ Search for secrets in commit history and full organisation by trufflehog : github.com/trufflesecurity/trufflehog

➡ Try finding sonarqube or Jenkins instances. Use #shodan for that. Check my previous thread for some ideas around it 😃 : twitter.com/AseemShrey/status/1508059759491964928

Here's how I found one : aseem-shrey.medium.com/mind-your-logs-how-a-build-log-from-a-jenkins-leaked-everything-603cf07fa85

➡ Look into website's javascript files. Here's a writeup around the same : infosecwriteups.com/one-token-to-leak-them-all-the-story-of-a-8000-npm-token-79b13af182a3

2️⃣ Verify those secrets : ➡ After you've found some secrets it's time to verify those. For each individual key look here : github.com/streaak/keyhacks You can use the latest trufflehog v3 to automatically verify for over 600 types of secrets as well 😃

3️⃣ Report 💰 ➡ Find the company's program on #hackerone or #bugcrowd or their own bug bounty page. ➡ If nothing like that exists, use connectbit to find contacts ➡ If even that doesn't help, check people on Linkedin or Twitter for that org

🅱🅾🅽🆄🆂 Here's a video of how to automatically find and verify secrets on github, s3 buckets etc using trufflehog v3 + an interview with the creator @InsecureNature Go on and check the video here : youtube.com/watch?v=iqC-hEd3hkE 📹 🚀