How to Find if Your Developers are Leaking Secrets?
summary
Lawrence Livermore penetration exercises show developers leak credentials through commits, shell profiles and histories, yielding discoverable AWS keys (about 400,000 AWS keys on GitHub in searches) and API tokens. Post‑exploit discovery includes unencrypted SSH keys, host fingerprints and git remotes, plus reuse of screen persistence to keep shells alive. Use version‑history scanners (18F, AWS Labs), static checkers like Bandit, and consider trimming repository history before pushing to public hosts to remove dangling secrets and secrets in old commits.
AI-written summary · about
chapters (10)
- 0:00Start
- 4:06Penetration Tests
- 4:41Penetration Test
- 6:19Environment Variables
- 10:22Ssh Configuration File
- 12:32The Known Hosts File
- 15:01Git Configuration
- 18:35Recap
- 21:51Service Account Histories
- 22:30Code Analysis Tools
related talks
33mGaining initial access by exploiting leaked credentials
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
33mWhoops! I Accidentally Leaked My Cloud Keys
30mWhoops! I Accidentally Leaked My Credentials (again)
39mSecrets Management: How to (not) help the person who hacks your servers get your data
48mHow Source Code is Revealing our Secrets
53mAre your secrets secure? How mobile applications are leaking millions of credentials