OWASP/wrongsecrets

create a secrets detection testbed branch with revoked credentials

開放

#201 建立於 2022年2月17日

 (3 則留言) (1 個反應) (0 位負責人)Java (601 個分叉)github user discovery
help wanted

倉庫指標

星標
 (1,457 顆星)
PR 合併指標
 (平均合併 4天 1小時) (30 天內合併 29 個 PR)

描述

Steps to take:

  • List secrets present in this issue
  • Create a link to this issue in the web interface https://github.com/commjoen/wrongsecrets/pull/250
  • Implement keys below in a separate branch with a script to generate a container from it which can be scanned
  • Add master merging script for the .github/scripts/docker-create-and-push.sh

Keys that can be added:

  • Azure
  • AWS
  • GCP
  • Git credentials :SSH key
  • Git credentials: developer token
  • private key RSA key & private ECC key
  • GPG keychain (armored and notarmored)
  • AES keys
  • Slack callback
  • kubeconfig
  • QR-code (will be hard to represent a secret which is detactable other than through entropy,skipping it)
  • BasicAuth
  • gradle credentials
  • mvn credentials
  • NPM
  • Firebase push notification keys (android/ios)
  • OTP Seed
  • segment.io access keys
  • Vault root token & unseal keys
  • Any JWT Token
  • Gitlab PAT
  • Gpg armoured export private and public keys
  • Azure devops access token
  • onepassword emergency kit, 1password-credentials.json and accesstokens
  • keybase paperkey
  • IBM-cloud?
  • Nomad credentials (wait till https://github.com/commjoen/wrongsecrets/issues/299 happens)
  • Spring boot Session token
  • Slack access tokens:bottoken & usertoken, applevel token & config token (requested..pending)
  • Braze API-keys (requested)
  • Lastpass integration/api-key
  • Confidant key
  • Docker hub access token
  • Vagrant cloud access token
  • confluence/jira secrets
  • AWS instance profile
  • add dockerconfig (https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/)
  • secrets above with encodings (base64, Hex encoding)
  • Database connection strings
  • OIDC token

which other secret would you like to add? please comment

貢獻者指南