hunt-secrets

Hunt: Exposed Secrets / Credential Exposure

Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "exposed secrets git directory .env config hardcoded API keys JS bundle source maps S3 CI leakage" via wiki-search MCP

Hub: [[web-moc]] (live index). Primary page: [[secret-hunting]]. Anchors: [[javascript-source-map-exploitation]], [[supply-chain-attacks]], [[git-exposure]], [[hardcoded-secrets-enumeration]], [[source-code-analysis]], [[aws-service-s3-buckets]], [[aws-access-token-secrets]]. Dorks: [[recon-dorks]].

Attack surface signals

Rank before probing - highest yield first: exposed .git/ (full source + history) > exposed .env/config files > JS bundles + source maps (rebuilt original source) > public repos (org + employee) > CI/CD build logs > S3/blob listings.

Path probes: /.git/, /.env, /.env.local, /.env.prod, /.git-credentials, /.aws/credentials, /config.json, /wp-config.php.bak, /.npmrc, /.netrc, /backup.zip, /.DS_Store Client-side: inline <script>, main.*.js bundles, *.js.map source maps, webpack chunks, __NEXT_DATA__, embedded firebaseConfig. Buckets/blobs: s3.amazonaws.com/<name>, <name>.s3.<region>.amazonaws.com, *.blob.core.windows.net, storage.googleapis.com/<name>. Repos: GitHub/GitLab org + employee personal repos, gists, forks, deleted-but-cached commits.

Methodology

Route the load-bearing confirming request (the exposed .git/.env fetch, or a key validity check) through Burp Repeater for operator visibility; quick loops below can stay in the terminal.

1. Probe exposed dotfiles/configs with curl (fixed path list, not an ID sweep):

for p in .env .env.local .git/HEAD .git-credentials .aws/credentials .npmrc config.json; do
  printf '%s -> ' "$p"; curl -s -o /dev/null -w "%{http_code}\n" "https://target.com/$p"
done

1. Exposed .git/ -> dump full repo, then mine history:

# /.git/HEAD returning a ref = exposed
curl -s https://target.com/.git/HEAD
git-dumper https://target.com/.git/ ./dump   # or wget -r the .git index
trufflehog filesystem ./dump --only-verified
gitleaks detect --source ./dump --no-banner

1. JS bundle + source map extraction:

# pull bundles, grep for key shapes
curl -s https://target.com/static/js/main.js | grep -Eo \
  '(AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|sk_live_[0-9A-Za-z]{24}|ghp_[0-9A-Za-z]{36}|xox[baprs]-[0-9A-Za-z-]+)'
# rebuild original source from a source map, then trufflehog it
npx source-map-explorer main.js main.js.map 2>/dev/null
trufflehog filesystem ./bundles --only-verified

1. S3 / blob enumeration - list to prove public read; pull at most one benign object as evidence, never bulk-sync real data (per hunt-core stop conditions):

aws s3 ls s3://<name> --no-sign-request          # public list = the proof
curl -s "https://storage.googleapis.com/<name>/" # GCS listing
curl -s "https://<name>.blob.core.windows.net/?comp=list"  # Azure blob
# evidence only, one benign object - do NOT `aws s3 sync` the whole bucket

1. Public-repo + org search:

trufflehog github --org=<org> --only-verified
# manual dorks (see [[recon-dorks]]):
#   "target.com" password   filename:.env   org:<org>
gitleaks detect --source ./cloned-repo --no-banner

1. CI/CD leakage: check build logs, GitHub Actions artifacts, pull_request_target output, exposed .gitlab-ci.yml vars, printed env in public job logs.
2. Collect every candidate secret with its type tag (aws/gcp/slack/stripe/github/db-uri) for the validation step.
3. Distill when confirmed (reusable exposure vector / extraction trick / key-validation endpoint, GENERIC, no client host): python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/osint/secret-hunting.md