A 3 step process to finding and reporting critical secrets :

https://abs.twimg.com/emoji/v2/... draggable="false" alt="🧵" title="collectie" aria-label="Emoji: collectie">https://abs.twimg.com/emoji/v2/... draggable="false" alt="👇" title="Rug van hand met omlaag wijzende wijsvinger" aria-label="Emoji: Rug van hand met omlaag wijzende wijsvinger">

https://abs.twimg.com/emoji/v2/... draggable="false" alt="1️⃣" title="Nummertoets een" aria-label="Emoji: Nummertoets een"> Find secrets :

https://abs.twimg.com/emoji/v2/... draggable="false" alt="➡" title="Pijl naar rechts" aria-label="Emoji: Pijl naar rechts"> Look into source control like Github, gitlab etc

Use github dorks for more directed searches. Like https://github.com/techgaun/github-dorks/blob/master/github-dorks.txt">https://github.com/techgaun/...

https://abs.twimg.com/emoji/v2/... draggable="false" alt="➡" title="Pijl naar rechts" aria-label="Emoji: Pijl naar rechts"> Search for secrets in commit history and full organisation by trufflehog : https://github.com/trufflesecurity/trufflehog">https://github.com/trufflese...

https://abs.twimg.com/emoji/v2/... draggable="false" alt="➡" title="Pijl naar rechts" aria-label="Emoji: Pijl naar rechts"> Try finding sonarqube or Jenkins instances. Use #shodan for that. Check my previous thread for some ideas around it https://abs.twimg.com/emoji/v2/... draggable="false" alt="😃" title="Lachend gezicht met open mond" aria-label="Emoji: Lachend gezicht met open mond"> : https://twitter.com/AseemShrey/status/1508059759491964928">https://twitter.com/AseemShre...

Here& #39;s how I found one : https://aseem-shrey.medium.com/mind-your-logs-how-a-build-log-from-a-jenkins-leaked-everything-603cf07fa85">https://aseem-shrey.medium.com/mind-your...

https://abs.twimg.com/emoji/v2/... draggable="false" alt="➡" title="Pijl naar rechts" aria-label="Emoji: Pijl naar rechts"> Look into website& #39;s javascript files. Here& #39;s a writeup around the same : https://infosecwriteups.com/one-token-to-leak-them-all-the-story-of-a-8000-npm-token-79b13af182a3">https://infosecwriteups.com/one-token...

https://abs.twimg.com/emoji/v2/... draggable="false" alt="2️⃣" title="Nummertoets twee" aria-label="Emoji: Nummertoets twee"> Verify those secrets :

https://abs.twimg.com/emoji/v2/... draggable="false" alt="➡" title="Pijl naar rechts" aria-label="Emoji: Pijl naar rechts"> After you& #39;ve found some secrets it& #39;s time to verify those. For each individual key look here : https://github.com/streaak/keyhacks

You">https://github.com/streaak/k... can use the latest trufflehog v3 to automatically verify for over 600 types of secrets as well https://abs.twimg.com/emoji/v2/... draggable="false" alt="😃" title="Lachend gezicht met open mond" aria-label="Emoji: Lachend gezicht met open mond">

https://abs.twimg.com/emoji/v2/... draggable="false" alt="3️⃣" title="Nummertoets drie" aria-label="Emoji: Nummertoets drie"> Report https://abs.twimg.com/emoji/v2/... draggable="false" alt="💰" title="Geldzak" aria-label="Emoji: Geldzak">

https://abs.twimg.com/emoji/v2/... draggable="false" alt="➡" title="Pijl naar rechts" aria-label="Emoji: Pijl naar rechts"> Find the company& #39;s program on #hackerone or #bugcrowd or their own bug bounty page.

https://abs.twimg.com/emoji/v2/... draggable="false" alt="➡" title="Pijl naar rechts" aria-label="Emoji: Pijl naar rechts"> If nothing like that exists, use connectbit to find contacts

https://abs.twimg.com/emoji/v2/... draggable="false" alt="➡" title="Pijl naar rechts" aria-label="Emoji: Pijl naar rechts"> If even that doesn& #39;t help, check people on Linkedin or Twitter for that org

https://abs.twimg.com/emoji/v2/... draggable="false" alt="🅱" title="Negatief vierkant Latijnse hoofdletter b" aria-label="Emoji: Negatief vierkant Latijnse hoofdletter b">https://abs.twimg.com/emoji/v2/... draggable="false" alt="🅾" title="Negatief vierkant Latijnse hoofdletter o" aria-label="Emoji: Negatief vierkant Latijnse hoofdletter o">🅽🆄🆂

Here& #39;s a video of how to automatically find and verify secrets on github, s3 buckets etc using trufflehog v3 + an interview with the creator @InsecureNature

Go on and check the video here : https://www.youtube.com/watch?v=iqC-hEd3hkE">https://www.youtube.com/watch... https://abs.twimg.com/emoji/v2/... draggable="false" alt="📹" title="Videocamera" aria-label="Emoji: Videocamera"> https://abs.twimg.com/emoji/v2/... draggable="false" alt="🚀" title="Raket" aria-label="Emoji: Raket">

You can read the unrolled version of this thread here: https://typefully.com/AseemShrey/s7zla3t">https://typefully.com/AseemShre...