Thread by @AseemShrey

A 3 step process to finding and reporting critical secrets :

🧵👇

1️⃣ Find secrets :

➡ Look into source control like Github, gitlab etc

Use github dorks for more directed searches. Like github.com/techgaun/githu…

➡ Search for secrets in commit history and full organisation by trufflehog : github.com/trufflesecurit…

➡ Try finding sonarqube or Jenkins instances. Use #shodan for that. Check my previous thread for some ideas around it 😃 :

https://twitter.com/AseemShrey/status/1508059759491964928

Here's how I found one : aseem-shrey.medium.com/mind-your-logs…

➡ Look into website's javascript files. Here's a writeup around the same : infosecwriteups.com/one-token-to-l…

2️⃣ Verify those secrets :

➡ After you've found some secrets it's time to verify those. For each individual key look here : github.com/streaak/keyhac…

You can use the latest trufflehog v3 to automatically verify for over 600 types of secrets as well 😃

3️⃣ Report 💰

➡ Find the company's program on #hackerone or #bugcrowd or their own bug bounty page.

➡ If nothing like that exists, use connectbit to find contacts

➡ If even that doesn't help, check people on Linkedin or Twitter for that org

🅱🅾🅽🆄🆂

Here's a video of how to automatically find and verify secrets on github, s3 buckets etc using trufflehog v3 + an interview with the creator @InsecureNature

Go on and check the video here : 📹 🚀

You can read the unrolled version of this thread here: typefully.com/AseemShrey/s7z…