1---2name: pentest-secrets-exposure3description: Discover hardcoded credentials, leaked API keys, exposed configuration files, sensitive data in artifacts, and information disclosure via error handling.4---56# Pentest Secrets Exposure78## Purpose9Spans multiple unchecked WSTG categories — CONF-03/04 (sensitive files, backups), INFO-05 (info leakage), ERRH-01/02 (error handling, stack traces). Shannon's pre-recon focuses on architecture, not systematic secrets discovery.1011## Prerequisites1213### Authorization Requirements14- **Written authorization** with source code access scope (if white-box)15- **Git repository access** for history mining (if applicable)16- **Target URL list** for exposed file probing1718### Environment Setup19- TruffleHog for git history secret scanning20- GitLeaks for pattern-based secret detection21- Semgrep with secrets ruleset22- nuclei with exposure templates2324## Core Workflow251. **Source Code Secrets**: Scan for hardcoded API keys, DB credentials, JWT signing keys, encryption keys using pattern + entropy detection.262. **Git History Mining**: Search all commits for secrets added then removed. Check force-pushed branches. Analyze .gitignore for sensitive patterns.273. **Exposed Config Files**: Probe for .env, .git/config, .DS_Store, wp-config.php, application.yml, docker-compose.yml with credentials (WSTG-CONF-03/04).284. **Error Handling Disclosure**: Trigger stack traces, debug pages, verbose errors revealing internal paths, DB schemas, framework versions (WSTG-ERRH-01/02).295. **Backup & Unreferenced Files**: .bak, .old, .swp, ~files, editor temp files, DB dumps, log files with sensitive data.306. **Client-Side Bundle Analysis**: Extract API keys from JS bundles, source maps exposing server code, hardcoded tokens in mobile packages.317. **Secret Validation**: Test each discovered credential for active access, document scope, assess blast radius.3233## WSTG Coverage3435| WSTG ID | Test Name | Status |36|---------|-----------|--------|37| WSTG-CONF-03 | Test File Extensions Handling for Sensitive Info | ✅ |38| WSTG-CONF-04 | Review Old Backup and Unreferenced Files | ✅ |39| WSTG-INFO-05 | Review Webpage Content for Information Leakage | ✅ |40| WSTG-ERRH-01 | Test Improper Error Handling | ✅ |41| WSTG-ERRH-02 | Test Stack Traces | ✅ |4243## Tool Categories4445| Category | Tools | Purpose |46|----------|-------|---------|47| Git Scanning | TruffleHog, GitLeaks | Secret detection in git history |48| Static Analysis | Semgrep (secrets rules), grep patterns | Source code secret scanning |49| Web Probing | nuclei (exposure templates), ffuf | Exposed file/config discovery |50| JS Analysis | SecretFinder, LinkFinder | Client-side bundle secret extraction |51| Validation | curl, custom scripts | Credential active-access testing |5253## References54- `references/tools.md` - Tool function signatures and parameters55- `references/workflows.md` - Attack pattern definitions and test vectors
jd-opensource