loading
Loading content
loading
Vulnerability Scanning
Pattern-match live HTTP responses for exposed secrets like API tokens and credentials. Reuses responses across searches to scan a URL fleet at once.
Exposed secrets in live HTTP responses are API tokens and credentials left sitting in HTML or JSON that anyone fetching the URL can read. This module pattern-matches those response bodies across thousands of URLs in a single pass, reusing each response so the fleet is not fetched twice. It finds what is already leaking in the body you fetched, not what might be at a guessed path.
You feed a live URL list. The module fetches those HTTP responses, pattern-matches the bodies for tokens and credentials already sitting in HTML or JSON, and reuses each response across searches so the fleet is not re-fetched per pattern. It does not guess .env paths, unpack a JavaScript AST, walk git history, or call a vendor to prove a key still works. Flags live on tool pages; the hard problem here is matching the body you already have without claiming the key is live.
Live URLs from Probe for Web Servers. Deeper page seeds from Discover Paths via Crawling and Discover Paths via Directory Brute Force.
findings into Generate Scan Report.
The other exposed-artifact modules on the same URL list: Scan for Exposed Admin Panels, Scan for Exposed Backups, and Scan for Sensitive Files. Each owns a different artifact class. Do not share one H1.
Nest this after you have live web URLs and you want the tokens already leaking in the response you fetched, not a file at a guessed path. A root URL list covers whatever those URLs already return. Nested pages still need path discovery upstream.
urls (FILE): live HTTP URLs, one per line. Example: https://foo.example.com, https://bar.example.com/app.
header (STRING): header(s) to include in HTTP requests.
header-file (FILE): file of header(s) to include.
rate-limit (STRING): max requests per second per machine. Default 300.
findings: JSONLines of finding details. Published fields: finding, location, severity, hostname, domain_name, ip_address, method, matches, and (v1.2.1) the HTTP request that triggered the row. README examples: GitHub Personal Access Token (ghp_...) and OpenAI API Key (sk_...), both info severity until you triage.
The tables this module produces. Sample rows are illustrative.
Pattern matches for exposed secrets in live HTTP response bodies.
findingtext | locationurl | severitytext | hostnametext | domain_nametext | ip_addresstext | methodtext | matchestext | requesttext | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | GitHub Personal Access Token | https://app.example.com/index.html | info | app.example.com | example.com | 203.0.113.10 | GET | ghp_<redacted> | GET /index.html HTTP/1.1 |
| 2 | OpenAI API Key | https://api.example.com/status.json | info | api.example.com | example.com | 203.0.113.20 | GET | sk-<redacted> | GET /status.json HTTP/1.1 |
| 3 | AWS Access Key ID | https://cdn.example.com/config.js | info | cdn.example.com | example.com | 198.51.100.42 | GET | AKIA<redacted> | GET /config.js HTTP/1.1 |
Artifact class it owns
Management / login UI; default creds on a subset
Upstream it needs
live urls
Artifact class it owns
Hostname-named .bak/.sql/zip/tarball
Upstream it needs
live urls
Scan for Exposed Secrets
Artifact class it owns
Patterns in the response you fetched
Upstream it needs
live urls
Artifact class it owns
.env, .git/config, logs, dev artifacts
Upstream it needs
live urls
questions
git history and vendor verification; not this job
JS regex only; not live HTTP
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.