Static Code Analysis
Find hardcoded keys and passwords in file dumps
Entropy and rules scan for hardcoded keys and passwords in large file trees.
overview
What dumpsterdiver does
In a Trickest workflow, dumpsterdiver is a Static Code Analysis node: point -p at a folder, get FOLDER and FILE findings of candidate secrets.
Reach for it on cloned repos, data dumps, or archives when key formats are unknown and regex alone will miss high-entropy blobs.
Tune with --level and --entropy, enable -s for password candidates, and use -a plus --grep-words or --exclude-files to bound the search. Versus dora, this path is broader entropy; versus bandit, it is language-agnostic.
use cases
Where dumpsterdiver fits
Find hardcoded keys in a data dump
Run dumpsterdiver over a folder of files so AWS, Azure, and SSH keys hidden in source, configs, or logs surface through entropy analysis.
Tune entropy by expected key length
Set the search level for short, typical, or long keys so the scan matches the kind of secret you expect and keeps false positives down.
Hunt for hardcoded passwords
Enable secret mode and set length and complexity thresholds so the scan flags real passwords without drowning in weak matches.
Apply custom rules to large datasets
Use advanced analysis with rules.yaml to report only files meeting a condition, like a CSV containing many email addresses.
reference
dumpsterdiver inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| path-to-files | FOLDER | -p | Path to the folder containing files to be analyzed. |
| secret | BOOLEAN | -s | Additionally analyze all files for hardcoded passwords. |
| advanced-analysis | BOOLEAN | -a | Analyze files using rules specified in rules.yaml. |
| search-level | STRING | --level | Search level for key length: 0 short, 1 typical (default), 2 long, 3 any. |
| enge-of-high-entropy | STRING | --entropy | Edge of high entropy (default 4.3). |
| grep-words | STRING | --grep-words | Grep words to look for, space-separated; requires -a. |
| files-to-exclude | STRING | --exclude-files | File names or extensions to skip during analysis. |
| remove | BOOLEAN | -r | Remove files that contain nothing interesting. |
Showing key inputs. dumpsterdiver exposes 14 inputs in total.
Full flag reference (14 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| remove | BOOLEAN | -r | When this flag is set, then files which don't contain any secret (or anything interesting if -a flag is set) will be removed. |
| secret | BOOLEAN | -s | When this flag is set, then all files will be additionally analyzed in search of hardcoded passwords. |
| grep-words | STRING | --grep-words | Specifies the grep words to look for. Multiple words should be separated by space. Wildcards are supported. Requires adding -a flag to the syntax. |
| search-level | STRING | --level | Search level for key length. Options: --level 0 - short keys (20-40B), e.g. AWS Access Key ID. --level 1 (default) - typical keys (40-70B), e.g. AWS Secret Access Key or Azure Shared Key. --level 2 - long keys (1000-1800B), e.g. SSH private key. --level 3 - any key (20-1800B). Be careful with this setting, because it may generate lots of false positives. |
| path-to-files | FOLDER | -p | Path to the folder containing files to be analyzed |
| max-key-length | STRING | --max-key | Specifies the maximum key length to be analyzed (default is 80). |
| min-key-length | STRING | --min-key | Specifies the minimum key length to be analyzed (default is 20). |
| bad-expressions | STRING | --bad-expressions | Specifies bad expressions. If the DumpsterDiver find such expression in a file, then this file won't be analyzed. Multiple bad expressions should be separated by space. |
| files-to-exclude | STRING | --exclude-files | Specifies file names or extensions which shouldn't be analyzed. File extension should contain . character (e.g. .pdf). Multiple file names and extensions should be separated by space. |
| advanced-analysis | BOOLEAN | -a | when this flag is set, then all files will be additionally analyzed using rules specified in rules.yaml file. |
| max-password-length | STRING | --max-pass | Specifies the maximum password length to be analyzed (default is 12). Requires adding -s flag to the syntax. |
| min-password-length | STRING | --min-pass | Specifies the minimum password length to be analyzed (default is 8). Requires adding -s flag to the syntax. |
| password-complexity | STRING | --pass-complex | Specifies the edge of password complexity between 1 (trivial passwords) to 9 (very complex passwords) (default is 8). Requires adding -s flag to the syntax. |
| enge-of-high-entropy | STRING | --entropy | Specifies the edge of high entropy (default is 4.3). |
example
Run dumpsterdiver
# scan a folder for keys and passwords at typical key lengthdumpsterdiver -p ./data -s --level 1 --entropy 4.3 --exclude-files .pdf .pngAnalyzing ./data ...[+] High entropy string (level 1) File: ./data/config/deploy.env:14 Entropy: 4.72 Length: 40[+] High entropy string (level 1) File: ./data/scripts/backup.sh:31 Entropy: 4.51 Length: 44[+] Password candidate (-s) File: ./data/app/settings.py:88 Complexity: 8[*] 3 findings across 2 filesguidance
Choosing dumpsterdiver
Use dumpsterdiver to sweep mixed file trees for hardcoded secrets when the exact key format is unknown. Prefer dora for regex-matched API keys with exploitation hints. Prefer bandit for Python-specific source analysis.
dora
Regex-based API key discovery with exploitation methods. dumpsterdiver leans on entropy and custom rules for broader coverage.
bandit
Security static analysis for Python source. dumpsterdiver is language-agnostic secret hunting across raw files.
faq
dumpsterdiver questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run dumpsterdiver yourself
A folder of files feeds DumpsterDiver, which runs entropy and rule analysis over them and writes the discovered secrets as a queryable output.
Facts on this page come from the live Trickest tool library.