secrets

Files (1)

• SKILL.md

SKILL.md (first lines)

# Secrets Hunting Phase

## Overview

Hunts credentials across every surface the target has ever touched:
JS bundles, GitHub repos, deleted commits, Postman collections, API specs, .env files, cloud configs.

This phase does NOT run generically. It reads exactly what recon found and targets THOSE
specific assets. TruffleHog runs on the actual JS bundle URLs from recon, not on the domain name.

See `references/intelligence-protocol.md` for the full coordination contract.

---

## Phase 0: Smart Intake (Run Before Any Tool)

```bash
source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh

p0_init_vars "$1"
p0_state_gate "HARVEST" || exit 0
p0_read_relay recon
p0_read_memory
p0_read_hypotheses

echo "=== SECRETS SMART INTAKE: $TARGET ==="
echo "State: $STATE | Top hypothesis: $TOP_HYPO_LABEL [$TOP_HYPO_PROB%]"
echo "JS bundles to scan: $(echo "$JS_BUNDLES" | wc -l | tr -d ' ')"
echo "GitHub orgs found: $(echo "$GITHUB_ORGS" | tr ' ' '\n' | wc -l | tr -d ' ')"
echo "Live hosts: $(echo "$LIVE_HOSTS" | wc -l | tr -d ' ')"
echo "AWS mode: $AWS_HINT | WAF: $WAF"
echo "ATW flagged (will skip): $ATW_FLAGGED"
echo ""
```

---

## Phase 1: Build Execution Manifest

Generate the manifest BEFORE running a single tool. Write it to session.json.
Every MUST item MUST complete before this phase ends.

```bash
# Build manifest items dynamically from smart intake
MANIFEST_ITEMS="[]"

# M01: TruffleHog on discovered JS bundles (MUST if bundles found)
[ -n "$JS_BUNDLES" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m01","tool":"trufflehog","target":"js_bundles","reason":"JS bundles found in recon - primary secret surface","priority":"MUST","status":"pending"}]')

# M02: TruffleHog on GitHub org (MUST if org found)
[ -n "$GITHUB_ORGS" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m02","tool":"trufflehog_github","target":"github_org","reason":"GitHub org identified in recon","priority":"MUST","status":"pending"}]')

# M03: Gitleaks on downloaded repos (SHOULD)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m03","tool":"gitleaks","target":"github_repos","reason":"Regex-based detection catches patterns TruffleHog misses","priority":"SHOULD","status":"pending"}]')

# M04: Postman collection hunting (MUST - often missed, high value)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m04","tool":"postman_hunt","target":"postman.com","reason":"Postman collections often contain API keys + internal endpoints","priority":"MUST","status":"pending"}]')

# M05: API spec hunting on all live hosts (MUST)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m05","tool":"swagger_hunt","target":"live_hosts","reason":"Exposed API specs reveal all endpoints including auth-required ones","priority":"MUST","status":"pending"}]')

# M06: .env / config file hunting (MUST)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m06","tool":"env_hunt","target":"live_hosts","reason":"Accidentally exposed config files","priority":"MUST","status":"pending"}]')

# M07: AWS-specific hunting (MUST if AWS hint)
[ "$AWS_HINT" = "true" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m07","tool":"trufflehog_aws","target":"all_surfaces","reason":"AWS detected in tech stack - hunt AKIA/ASIA keys specifically","priority":"MUST","status":"pending"}]')

# M08: GitHub dorking (SHOULD)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m08","tool":"github_dorking","target":"github.com","reason":"Manual dorks find what automated scans miss","priority":"SHOULD","status":"pending"}]')

# M09: Wayback/Archive secret hunting (SHOULD - old JS versions)
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"m09","tool":"wayback_js","target":"archived_js","reason":"Old JS versions often contain deleted-but-committed secrets","priority":"SHOULD","status":"pending"}]')

# Write manifest to session.json
jq --argjson items "$MANIFEST_ITEMS" \
  '.scalpel.active_manifest = {"phase":"secrets","generated_at":"'"$(date '+%Y-%m-%d %H:%M')"'","items":$items}' \
  $SESSION > /tmp/s.json && mv /tmp/s.json $SESSION

echo "=== EXECUTION MANIFEST GENERATED ==="
jq '.scalpel.active_manifest.items[] | "[\(.priority)] \(.id): \(.tool) on \(.target)"' $SESSION
echo ""
```

---

## Phase 2: Execute Manifest — TruffleHog on JS Bundles (M01)

**Run on the SPECIFIC JS bundle URLs found in recon. Not on the domain generically.**

```bash
mkdir -p $RESULTS/secrets/js-bundles

# Download each discovered JS bundle and scan it
echo "$JS_BUNDLES" | while read URL; do
  [ -z "$URL" ] && continue
  FILENAME=$(echo $URL | md5sum | cut -d' ' -f1).js
  curl -sk "$URL" -o "$RESULTS/secrets/js-bundles/$FILENAME" 2>/dev/null
  echo "$URL -> $FILENAME" >> $RESULTS/secrets/js-url-map.txt
done

# TruffleHog on downloaded JS files
trufflehog filesystem $RESULTS/secrets/js-bundles/ \
  --only-verified \
  --json 2>/dev/null | tee $RESULTS/secrets/trufflehog-js.json

# Also scan any JS files recon already downloaded
[ -d $RESULTS/recon/js/files/ ] && \
  trufflehog filesystem $RESULTS/recon/js/files/ \
    --only-verified \
    --json 2>/dev/null | tee -a $RESULTS/secrets/trufflehog-js.json

# SecretFinder as backup (regex-based, catches patterns TruffleHog misses)
python3 ~/tools/SecretFinder/SecretFinder.py \
  -i $RESULTS/secrets/js-bundles/ \
  -o $RESULTS/secrets/secretfinder-js.txt 2>/dev/null

echo "[M01] TruffleHog JS scan: $(cat $RESULTS/secrets/trufflehog-js.json 2>/dev/null | jq 'select(.Verified==true)' | wc -l) verified secrets"

From kalpmodi/akira, MIT.

More from kalpmodi/akira