Exploitation A07 | Authentication Failures A02 | Security Misconfiguration

Secrets Exposure

Hardcoded credentials, API keys, tokens, and other secrets in web applications represent one of the most common and impactful vulnerabilities. Secrets can be found in JavaScript source, HTML comments, exposed configuration files, git repositories, and API responses.

Danger

A single exposed AWS key can lead to complete cloud infrastructure compromise in minutes. Automated bots scan GitHub and public sites for leaked secrets 24/7.

Frameworks: WSTG-CONF-04, WSTG-INFO-05 · ASVS 5.0 V13.3.1, V14.1.1 · CWE-798, CWE-312 · T1552.001

Client-Side Secret Discovery

client-side-secret-scan.sh

# Search JavaScript files for secrets:
curl -s https://target.com/js/app.js | grep -iE \
  'api[_-]?key|apikey|secret|token|password|passwd|auth|credential|private[_-]?key'

# Search all JS files:
curl -s https://target.com/sitemap.xml | grep -oP 'https?://[^<]+\.js' | while read url; do
  echo "--- $url ---"
  curl -s "$url" | grep -inE 'api[_-]?key|secret|token|password|aws|firebase'
done

# Check HTML source for comments with secrets:
curl -s https://target.com | grep -iE '<!--.*(?:password|secret|key|token|TODO|FIXME|HACK)'

# Check for hardcoded Firebase config:
curl -s https://target.com | grep -oE 'AIza[0-9A-Za-z_-]{35}'

# LinkFinder - extract hidden URLs and parameters from JS:
python3 linkfinder.py -i https://target.com/js/app.js -o cli

Source maps are another client-side artefact that can reveal original code; recognising and fetching them is covered on the Information Disclosure guide. → Source-code exposure (canonical guide)

Server-Side Secret Discovery

Server-side secrets most often leak through exposed environment and configuration files — .env, appsettings.json, application.properties, docker-compose.yml. The enumeration mechanics for reaching them (probing .env, backup files, debug panels, and framework endpoints such as Spring Actuator) are documented once on the Information Disclosure guide; this page keeps its focus on triaging what those files expose.

→ Debug endpoints & hidden files (canonical guide)

Git Repository Mining

An exposed .git/ directory lets you reconstruct the full source tree, and — more relevant here — secrets that were committed and later deleted still live in history. Detecting and dumping the repository (/.git/HEAD, git-dumper) is covered on the Information Disclosure guide; the secret-specific step is scanning the recovered history with trufflehog or gitleaks, then reading deleted files with git show <commit>:.env.

→ Source-code exposure (canonical guide)

Common Secret Patterns (Regex)

AWS Access Key: AKIA[0-9A-Z]{16}

AWS Secret Key: [0-9a-zA-Z/+]{40}

GitHub Token: gh[opsru]_[A-Za-z0-9_]{36,}

Slack Token: xox[baprs]-[0-9a-zA-Z-]{10,}

Google API Key: AIza[0-9A-Za-z_-]{35}

Stripe Key: sk_live_[0-9a-zA-Z]{24,}

JWT Token: eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

Private Key: -----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----

Generic Password: (?i)(password|passwd|pwd)\s*[=:]\s*['"'][^'"']{4,}

Testing Checklist

☐ 1. Search all JavaScript files for API keys, tokens, and credentials
☐ 2. Check for source maps and download original source code
☐ 3. Check HTML comments for credentials and internal URLs
☐ 4. Probe for .env, config files, and backup files
☐ 5. Check for exposed .git repository and mine commit history
☐ 6. Check API responses for excessive data (tokens, internal IDs)
☐ 7. Run truffleHog or gitleaks on any exposed source code
☐ 8. Verify found secrets are active (but minimize scope — only confirm, don't exploit)

Evidence Collection

Secret Location: URL, file, or endpoint where the secret was found

Secret Type: API key, database password, private key, etc.

Verification: Proof the secret is active (redact the actual secret in your report)

CVSS Range: Read-only API key: 5.3–6.5 | Admin credentials: 9.1–9.8 | Cloud keys: 9.1–10.0

Remediation

• Rotate immediately: Any exposed secret must be revoked and rotated, not just removed from code.
• Environment variables: Store secrets in environment variables or a secrets manager (Vault, AWS Secrets Manager).
• Pre-commit hooks: Use tools like git-secrets, detect-secrets, or gitleaks as pre-commit hooks.
• CI/CD scanning: Integrate secret scanning in the build pipeline (GitHub Secret Scanning, GitLab Secret Detection).
• Block .env/.git: Configure web server to deny access to sensitive files and directories.

False Positive Identification

Example/placeholder keys: Strings like AKIAIOSFODNN7EXAMPLE or test-api-key-1234 are documentation examples, not real secrets — verify the key is valid by testing it (with authorization).
Revoked credentials: Exposed secrets in old git commits may already be rotated — note the exposure but verify current validity before rating severity.
Public API keys: Some API keys are designed to be public (e.g., Google Maps browser keys with domain restrictions) — check if the key has usage restrictions configured.