secrets

Secrets Hunting Phase

Overview

Hunts credentials across every surface the target has ever touched: JS bundles, GitHub repos, deleted commits, Postman collections, API specs, .env files, cloud configs.

This phase does NOT run generically. It reads exactly what recon found and targets THOSE specific assets. TruffleHog runs on the actual JS bundle URLs from recon, not on the domain name.

See references/intelligence-protocol.md for the full coordination contract.

---

Phase 0: Smart Intake (Run Before Any Tool)

source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh

p0_init_vars "$1"
p0_state_gate "HARVEST" || exit 0
p0_read_relay recon
p0_read_memory
p0_read_hypotheses

echo "=== SECRETS SMART INTAKE: $TARGET ==="
echo "State: $STATE | Top hypothesis: $TOP_HYPO_LABEL [$TOP_HYPO_PROB%]"
echo "JS bundles to scan: $(echo "$JS_BUNDLES" | wc -l | tr -d ' ')"
echo "GitHub orgs found: $(echo "$GITHUB_ORGS" | tr ' ' '\n' | wc -l | tr -d ' ')"
echo "Live hosts: $(echo "$LIVE_HOSTS" | wc -l | tr -d ' ')"
echo "AWS mode: $AWS_HINT | WAF: $WAF"
echo "ATW flagged (will skip): $ATW_FLAGGED"
echo ""

---

Phase 1: Build Execution Manifest

Generate the manifest BEFORE running a single tool. Write it to session.json. Every MUST item MUST complete before this phase ends.

# Build manifest items dynamically from smart intake
MANIFEST_ITEMS="[]"

# M01: TruffleHog on discovered JS bundles (MUST if bundles found)
[ -n "$JS_BUNDLES" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m01","tool":"trufflehog","target":"js_bundles","reason":"JS bundles found in recon - primary secret surface","priority":"MUST","status":"pending"}]')

# M02: TruffleHog on GitHub org (MUST if org found)
[ -n "$GITHUB_ORGS" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m02","tool":"trufflehog_github","target":"github_org","reason":"GitHub org identified in recon","priority":"MUST","status":"pending"}]')

# M03: Gitleaks on downloaded repos (SHOULD)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m03","tool":"gitleaks","target":"github_repos","reason":"Regex-based detection catches patterns TruffleHog misses","priority":"SHOULD","status":"pending"}]')

# M04: Postman collection hunting (MUST - often missed, high value)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m04","tool":"postman_hunt","target":"postman.com","reason":"Postman collections often contain API keys + internal endpoints","priority":"MUST","status":"pending"}]')

# M05: API spec hunting on all live hosts (MUST)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m05","tool":"swagger_hunt","target":"live_hosts","reason":"Exposed API specs reveal all endpoints including auth-required ones","priority":"MUST","status":"pending"}]')

# M06: .env / config file hunting (MUST)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m06","tool":"env_hunt","target":"live_hosts","reason":"Accidentally exposed config files","priority":"MUST","status":"pending"}]')

# M07: AWS-specific hunting (MUST if AWS hint)
[ "$AWS_HINT" = "true" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m07","tool":"trufflehog_aws","target":"all_surfaces","reason":"AWS detected in tech stack - hunt AKIA/ASIA keys specifically","priority":"MUST","status":"pending"}]')

# M08: GitHub dorking (SHOULD)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m08","tool":"github_dorking","target":"github.com","reason":"Manual dorks find what automated scans miss","priority":"SHOULD","status":"pending"}]')

# M09: Wayback/Archive secret hunting (SHOULD - old JS versions)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m09","tool":"wayback_js","target":"archived_js","reason":"Old JS versions often contain deleted-but-committed secrets","priority":"SHOULD","status":"pending"}]')

# Write manifest to session.json
jq --argjson items "$MANIFEST_ITEMS" \
  '.scalpel.active_manifest = {"phase":"secrets","generated_at":"'"$(date '+%Y-%m-%d %H:%M')"'","items":$items}' \
  $SESSION > /tmp/s.json && mv /tmp/s.json $SESSION

echo "=== EXECUTION MANIFEST GENERATED ==="
jq '.scalpel.active_manifest.items[] | "[\(.priority)] \(.id): \(.tool) on \(.target)"' $SESSION
echo ""