| name | secrets-and-dorks |
| description | 48-pattern secret regex catalog, 70 dork corpus across 9 categories, GitHub code-search dorks, and 9 read-only credential validators for authorized secret discovery and verification. |
| version | 1.0.0 |
| triggers | ["secret scanning","secret leak","leaked credential","github dorking","google dorking","bing dorking","DDG dorking","regex catalog","API key regex","Anthropic API key","OpenAI API key","AWS key","GitHub PAT","secret validator","breach lookup","credential validation","JS secret scan","sourcemap leak"] |
Secrets & Dorks
Sub-skill of offensive-osint. Load osint-methodology for pipeline and triage context.
Authorized targets only. Read-only validators only — never use a validated credential to create, modify, or delete anything.
BEHAVIORAL CONTRACT
When triggered: Secret scanning, leaked credential hunting, GitHub/Google/Bing dorking, API key discovery, or credential verification is needed.
Execute:
- Run the 48-pattern secret catalog (§1) against the target corpus — GitHub code, Postman workspaces, JS bodies, sourceMaps, mobile strings, Wayback HTML, paste sites, Stack Exchange code blocks. Process patterns in order (most-specific first) to minimize false positives.
- Run the dork corpus (§2) across Google, Bing, Brave, DDG — substitute
{domain} and {company}. Run across multiple engines (they surface different results).
- Run GitHub code-search dorks (§3) against the target domain stem, full domain, and company name.
- For every secret match: classify by catalog severity, then validate using the matching read-only validator from §4 (if one exists for that provider).
- Never validate credentials for which no read-only endpoint exists. Never validate AWS root ARNs (
:root).
- For validated-live credentials: emit
SECRET_LEAK finding at catalog severity, then chain to post-discovery for enumeration (gated on RoE).
Output: SECRET_LEAK findings per osint-methodology §3 schema. Validator results per §4.10 schema (status, provider, account_id, scope, checked_at, detectability).
Severity rules: Per catalog table (§1). False-positive-prone patterns (22 JWT, 23 Bearer, 29 Generic) require context check before emitting.
Gating rules: Read-only validators only. Never create/modify/delete/send. Tag every validation with detectability + checked_at UTC.
Chain to: Feed validated-live credentials to post-discovery for enumeration workflows. Feed GitHub dork results through §1 catalog for automated secret scanning. Feed all findings to analysis-and-reporting for severity classification and attack-path hints.
1. Secret-Pattern Catalog — 48 Patterns
Run against: GitHub code, Postman workspaces, JS bodies, sourcesContent blobs, mobile strings, Wayback HTML, paste sites, Stack Exchange code blocks. Order matters: most-specific first.
| # | Name | Regex | Severity | Category |
|---|
| 1 | AWS Access Key | \b(AKIA|ASIA)[0-9A-Z]{16}\b | CRITICAL | aws |
| 2 | AWS Secret Key (typed) | (?i)aws[_\-]?secret[_\-]?access[_\-]?key['"\s:=]+([A-Za-z0-9/+=]{40}) | CRITICAL | aws |
| 3 | AWS Secret (loose) | (?i)aws(.{0,20})?(secret|sk)["'=: ]+([0-9a-z/+=]{40}) | HIGH | aws |
| 4 | GCP Service Account JSON | "type"\s*:\s*"service_account" | CRITICAL | gcp |
| 5 | Google API Key | \bAIza[0-9A-Za-z_\-]{35}\b | HIGH | gcp |
| 6 | GitHub Classic PAT | \bghp_[A-Za-z0-9]{36}\b | CRITICAL | github |
| 7 | GitHub Fine-grained PAT | \bgithub_pat_[A-Za-z0-9_]{82}\b | CRITICAL | github |
| 8 | GitHub OAuth | \bgho_[A-Za-z0-9]{36}\b | HIGH | github |
| 9 | GitHub Server-to-Server | \bgh[usr]_[A-Za-z0-9]{36,}\b | HIGH | github |
| 10 | Stripe Live Key | \bsk_live_[0-9A-Za-z]{24,}\b | CRITICAL | stripe |
| 11 | Stripe Test Key | \bsk_test_[0-9A-Za-z]{24,}\b | LOW | stripe |
| 12 | Slack Token | \bxox[abpors]-[0-9A-Za-z\-]{10,48}\b | HIGH | slack |
| 13 | Slack Webhook | <https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+> | MEDIUM | slack |
| 14 | SendGrid Key | |
False-positive notes:
- Patterns 22 (JWT), 23 (Bearer), 29 (Generic) trigger on test/example data. Always check context.
- Pattern 16 (Mailgun loose) and 11 (Stripe test) are intentionally noisy; severity is low.
- Pattern 24 (Basic auth URL) catches monitoring URLs and CI debug URLs — verify before alerting.
2. Dork Corpus — 70 Templates, 9 Categories
Substitute {domain} = example.com, {company} = Acme Corporation. Run via Google, Bing, Brave, DDG, Yandex — engines surface different results.
2.1 Files
site:{domain} filetype:env
site:{domain} ext:env OR ext:ini OR ext:cfg OR ext:conf
site:{domain} ext:sql OR ext:sqlite OR ext:dump OR ext:bak
site:{domain} ext:pem OR ext:key OR ext:p12 OR ext:pfx
site:{domain} ext:log
site:{domain} intitle:"index of"
site:{domain} inurl:.git OR inurl:/.git/
site:{domain} inurl:backup OR inurl:.bak OR inurl:old
site:{domain} ext:yml OR ext:yaml
site:{domain} ext:properties
2.2 Admin / Login Panels
site:{domain} inurl:admin OR inurl:login OR inurl:sso OR inurl:dashboard
site:{domain} intitle:"phpMyAdmin"
site:{domain} intitle:"Jenkins"
site:{domain} intitle:"Grafana"
site:{domain} intitle:"Kibana"
site:{domain} intitle:"Splunk"
site:{domain} (intitle:"login" OR intitle:"sign in")
site:{domain} intitle:"GitLab"
site:{domain} intitle:"Swagger" OR intitle:"OpenAPI"
site:{domain} inurl:phpinfo
2.3 Secrets / Credential Leakage
"{domain}" ("api_key" OR "apikey" OR "access_token")
"{domain}" (password OR passwd OR pwd)
site:pastebin.com "{domain}"
site:ghostbin.com "{domain}"
site:rentry.co "{domain}"
site:gist.github.com "{domain}"
site:hastebin.com "{domain}"
"{domain}" "BEGIN RSA PRIVATE KEY"
2.4 Cloud / CI / Shadow-IT
site:s3.amazonaws.com "{domain}"
site:storage.googleapis.com "{domain}"
site:blob.core.windows.net "{domain}"
site:digitaloceanspaces.com "{domain}"
site:trello.com "{domain}"
site:*.atlassian.net "{domain}"
site:dev.azure.com "{domain}"
site:bitbucket.org "{domain}"
site:firebaseio.com "{domain}"
site:herokuapp.com "{domain}"
2.5 Docs / Intel Mining
site:{domain} filetype:pdf (confidential OR internal OR restricted)
site:{domain} filetype:xlsx OR filetype:csv
site:{domain} filetype:docx
site:scribd.com "{company}"
"{company}" filetype:pdf (salary OR payroll OR org-chart OR "organization chart")
site:slideshare.net "{company}"
2.6 Vuln Indicators
site:{domain} intext:"sql syntax" OR intext:"you have an error in your sql"
site:{domain} intext:"Warning: mysql_"
site:{domain} intext:"Fatal error:" intext:"on line"
site:{domain} intext:"stack trace" OR intext:"Traceback (most recent call last)"
"Apache/2.4.49" site:{domain}
site:{domain} inurl:wp-content OR inurl:wp-includes
site:{domain} intext:"Directory listing for /"
site:{domain} intitle:"Apache2 Ubuntu Default Page"
2.7 Internal Tool Exposure
site:{domain} intitle:"Prometheus Time Series"
site:{domain} intitle:"Argo CD"
site:{domain} intitle:"Sonarqube"
site:{domain} intitle:"Confluence"
site:{domain} intitle:"Jira"
site:{domain} inurl:"/jenkins/"
site:{domain} intitle:"Portainer"
site:{domain} intitle:"Rancher"
2.8 Backup / Dump File Extensions
site:{domain} ext:bak OR ext:backup OR ext:old OR ext:orig OR ext:save OR ext:swp
site:{domain} ext:tar OR ext:tar.gz OR ext:tgz OR ext:zip OR ext:rar OR ext:7z
site:{domain} ext:db OR ext:sqlite OR ext:sqlite3 OR ext:mdb
site:{domain} ext:dump OR ext:rdb OR ext:bson
site:{domain} (intext:"-- MySQL dump" OR intext:"PostgreSQL database dump")
2.9 Sector-Specific
# Healthcare
site:{domain} (filetype:pdf OR filetype:xlsx) (HIPAA OR PHI OR "patient records")
site:{domain} ("DICOM" OR "HL7" OR "ICD-10")
# Finance
site:{domain} (filetype:pdf OR filetype:xlsx) (SOC OR "audit report" OR "internal control")
site:{domain} ("SWIFT" OR "BIC" OR IBAN OR "wire transfer")
# Gov / public sector
site:{domain} (filetype:pdf OR filetype:doc) (FOUO OR "controlled unclassified" OR CUI)
3. GitHub Code-Search Dorks — 13 Dorks
Apply each to {target} (root domain stem), {domain} (full root domain), and {company}:
"{target}" filename:.env
"{target}" filename:.env.example
"{target}" filename:config
"{target}" AWS_ACCESS_KEY_ID
"{target}" AWS_SECRET_ACCESS_KEY
"{target}" password
"{target}" api_key
"{target}" secret
"{target}" authorization: Bearer
"{target}" filename:id_rsa
"{target}" filename:.git-credentials
"{target}" filename:wp-config.php
"@{domain}" password
For each result: fetch file → run secret catalog → if hit → SECRET_LEAK finding with catalog severity, evidence = repo URL + file path + matched secret (truncate, last 4 chars only).
4. Read-Only Secret Validators
Hard rules: read-only endpoint only. Never create, modify, delete, or send anything. Tag every validation with detectability and UTC checked_at.
4.1 Postman PMAK
curl -sk -m 10 -H "X-Api-Key: PMAK-..." https://api.getpostman.com/me | jq .
200 → live (returns user id/email). 401 → dead. Detectability: low.
4.2 AWS Access Key
import boto3
sts = boto3.client('sts', aws_access_key_id='AKIA...', aws_secret_access_key='...', region_name='us-east-1')
print(sts.get_caller_identity())
Valid → returns Account ID + ARN + UserId. :root ARN = do NOT validate. Detectability: medium (CloudTrail logs GetCallerIdentity).
4.3 GitHub PAT
curl -sk -m 10 -H "Authorization: token ghp_..." https://api.github.com/user -D /tmp/h | jq -r '.login,.email'
grep -i 'X-OAuth-Scopes' /tmp/h
200 → live. Scope in X-OAuth-Scopes. repo scope = write access. Detectability: low.
4.4 Slack Token
curl -sk -m 10 -H "Authorization: Bearer xoxb-..." -X POST https://slack.com/api/auth.test | jq .
{"ok": true} → live (includes team, user IDs). Detectability: low.
4.5 Anthropic API Key
curl -sk -m 10 -H "x-api-key: sk-ant-api03-..." -H "anthropic-version: 2023-06-01" \
https://api.anthropic.com/v1/models | jq '.data | length'
200 → live. 401 → dead. 403 org_disabled → key valid but org disabled. Detectability: low.
4.6 OpenAI API Key
curl -sk -m 10 -H "Authorization: Bearer sk-..." https://api.openai.com/v1/models | jq '.data | length'
200 → live. 429 → live but quota exhausted. Detectability: low.
4.7 npm Token
curl -sk -m 10 -H "Authorization: Bearer npm_..." https://registry.npmjs.org/-/whoami | jq .
200 with {"username": "..."} → live. Detectability: low.
4.8 Atlassian API Token
curl -sk -m 10 -u "email:ATATT3xFfGF0_..." \
https://<workspace>.atlassian.net/rest/api/3/myself | jq .
200 → live (returns account profile). Detectability: low.
4.9 DataDog API + APP Key
curl -sk -m 10 -H "DD-API-KEY: ..." -H "DD-APPLICATION-KEY: ..." \
https://api.datadoghq.com/api/v1/validate | jq .
200 → both keys valid. 403 → either key invalid. Detectability: low; appears in DataDog audit log.
4.10 Validator Output Schema
{
"status": "verified_live | verified_dead | scope_restricted | validation_skipped_by_policy",
"provider": "postman | aws | github | slack | anthropic | openai | npm | atlassian | datadog",
"account_id": "<opaque>",
"scope": "<freeform>",
"checked_at": "<UTC ISO8601>",
"detectability": "low | medium | high"
}
After validator confirms live → see post-discovery sub-skill for enumeration workflows (NOT read-only).
Structured Outrider run contract
Follow the shared run-contract instructions in ../_shared/run-contract.md.
- Contract skill identifier:
secrets-and-dorks.
- Consume
skill_request version 1 and produce skill_result version 1 when participating in an Outrider run.
- Use evidence IDs for all claims; do not cite unregistered local paths as claim evidence.
- Discoveries are observations and do not expand scope or approval.
- Do not claim final finding validation; use
finding_candidate only when a human-reviewed candidate should be handed off.
- Do not directly edit
manifest.json, scope.yaml, run.jsonl, evidence.jsonl, or approvals.jsonl.
- Use policy-gated MCP with the explicit
run_dir; the Python control layer and MCP boundary must reevaluate current controls.
