secret-extraction

Secret & Credential Extraction

Extract hardcoded credentials, API keys, cryptographic material, certificates, configuration secrets, and sensitive data from compiled binaries. This skill covers the full pipeline: string extraction, pattern matching, entropy analysis, crypto identification, format-specific extraction, and anti-analysis bypass.

Why This Matters

Hardcoded secrets in binaries are among the highest-impact findings in both penetration testing and malware analysis. A single embedded AWS key grants cloud access. A hardcoded database password opens the entire backend. An extracted C2 encryption key lets you decrypt all traffic. Developers embed secrets assuming compilation hides them -- it does not.

Methodology Overview

Execute these phases in order. Each phase feeds the next.

Phase 1 — Triage and Hash

Before touching strings, identify what you have. File type determines extraction strategy.

file <binary>
sha256sum <binary>
node ${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js hash <binary>

Record the hash. Check if this binary was already analyzed:

node ${CLAUDE_PLUGIN_ROOT}/scripts/analysis-tracker.js check <sha256> string-extraction

Phase 2 — Static String Extraction

Extract all readable strings. Start broad, then filter.

# ASCII strings, 6+ chars (reduces noise vs default 4)
strings -a -n 6 <binary> > strings_ascii.txt

# UTF-16 LE (Windows wchar_t, most common for Windows binaries)
strings -a -n 6 -el <binary> > strings_utf16.txt

# Combine and deduplicate
cat strings_ascii.txt strings_utf16.txt | sort -u > strings_all.txt

Count and triage:

wc -l strings_all.txt
# < 500 lines: review manually
# 500-5000: filter with patterns below
# > 5000: use targeted extraction only

Phase 3 — Obfuscated String Recovery

FLOSS recovers strings that strings cannot see: stack-built strings, tight loops, and runtime-decoded strings. This is where the real secrets hide.

# Full analysis (slow but thorough)
floss <binary>

# Stack strings only (fast, catches char-by-char construction)
floss --only stack <binary>

# Decoded strings (emulation-based, slowest, highest value)
floss --only decoded <binary>

# JSON output for automated processing
floss -j <binary> > floss_output.json