hardcoded-credential-hunt

Hardcoded Credential Hunt

Detect credentials baked into client-side code or HTML responses. Targets include master passwords in form value attributes, secret keys in inline scripts, API tokens in configuration endpoints, and plaintext credentials leaked through debug error pages. This class of vulnerability bypasses authentication entirely — no brute force required.

When to Use

• An application serves HTML forms with pre-filled or hidden password fields.
• A configuration endpoint (/api/config, /env, /settings) returns JSON with credential-like strings.
• A debug/error page leaks application secrets in JavaScript variables.
• An unauthenticated API endpoint returns data that controls authentication (reset, exit registration, admin actions).
• JavaScript bundles contain string assignments matching password patterns.

Prerequisites

• terminal with curl and python3.
• A target serving HTML, JSON, or JavaScript without proper authentication on configuration/settings endpoints.
• Access to at least one public page, form, or API endpoint.

Quick Detection

# Scan HTML for password fields with pre-filled values
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/PATH" | grep -Eoi '(?:password|passwd|senha|pass|pwd|secret)\s*[=:"]\s*"?[^"&\s]{4,30}"?' | head -10

# Scan JSON config endpoints for credential-like keys
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/config" | python3 -c "
import sys, json, re
try:
    data = json.load(sys.stdin)
    for k, v in data.items() if isinstance(data, dict) else []:
        if any(x in k.lower() for x in ['pass','secret','key','token','auth']):
            print(f'{k}: {v}')
except: pass
"

# Scan inline JavaScript for hardcoded secrets
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/" | grep -Eo '(?:SECRET|PASSWORD|API_KEY|TOKEN)\s*=\s*"[^"]{8,}"' | head -10

Procedure

Phase 1 — HTML Form Inspection

Look for password fields with value attributes or hidden inputs containing credentials: