loading
Loading content
loading
Static Code Analysis
Entropy and rules scan for hardcoded keys and passwords in large file trees.
overview
In a Trickest workflow, dumpsterdiver is a Static Code Analysis node: point -p at a folder, get FOLDER and FILE findings of candidate secrets.
Reach for it on cloned repos, data dumps, or archives when key formats are unknown and regex alone will miss high-entropy blobs.
Tune with --level and --entropy, enable -s for password candidates, and use -a plus --grep-words or --exclude-files to bound the search. Versus dora, this path is broader entropy; versus bandit, it is language-agnostic.
use cases
Run dumpsterdiver over a folder of files so AWS, Azure, and SSH keys hidden in source, configs, or logs surface through entropy analysis.
Set the search level for short, typical, or long keys so the scan matches the kind of secret you expect and keeps false positives down.
Enable secret mode and set length and complexity thresholds so the scan flags real passwords without drowning in weak matches.
Use advanced analysis with rules.yaml to report only files meeting a condition, like a CSV containing many email addresses.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| path-to-files | FOLDER | -p | Path to the folder containing files to be analyzed. |
| secret | BOOLEAN | -s | Additionally analyze all files for hardcoded passwords. |
| advanced-analysis | BOOLEAN | -a | Analyze files using rules specified in rules.yaml. |
| search-level | STRING | --level | Search level for key length: 0 short, 1 typical (default), 2 long, 3 any. |
| enge-of-high-entropy | STRING | --entropy | Edge of high entropy (default 4.3). |
| grep-words | STRING | --grep-words | Grep words to look for, space-separated; requires -a. |
| files-to-exclude | STRING | --exclude-files | File names or extensions to skip during analysis. |
| remove | BOOLEAN | -r | Remove files that contain nothing interesting. |
Showing key inputs. dumpsterdiver exposes 14 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| remove | BOOLEAN | -r | When this flag is set, then files which don't contain any secret (or anything interesting if -a flag is set) will be removed. |
| secret | BOOLEAN | -s | When this flag is set, then all files will be additionally analyzed in search of hardcoded passwords. |
| grep-words | STRING | --grep-words | Specifies the grep words to look for. Multiple words should be separated by space. Wildcards are supported. Requires adding -a flag to the syntax. |
| search-level | STRING | --level | Search level for key length. Options: --level 0 - short keys (20-40B), e.g. AWS Access Key ID. --level 1 (default) - typical keys (40-70B), e.g. AWS Secret Access Key or Azure Shared Key. --level 2 - long keys (1000-1800B), e.g. SSH private key. --level 3 - any key (20-1800B). Be careful with this setting, because it may generate lots of false positives. |
| path-to-files | FOLDER | -p | Path to the folder containing files to be analyzed |
| max-key-length | STRING | --max-key | Specifies the maximum key length to be analyzed (default is 80). |
| min-key-length | STRING | --min-key | Specifies the minimum key length to be analyzed (default is 20). |
| bad-expressions | STRING | --bad-expressions | Specifies bad expressions. If the DumpsterDiver find such expression in a file, then this file won't be analyzed. Multiple bad expressions should be separated by space. |
| files-to-exclude | STRING | --exclude-files | Specifies file names or extensions which shouldn't be analyzed. File extension should contain . character (e.g. .pdf). Multiple file names and extensions should be separated by space. |
| advanced-analysis | BOOLEAN | -a | when this flag is set, then all files will be additionally analyzed using rules specified in rules.yaml file. |
| max-password-length | STRING | --max-pass | Specifies the maximum password length to be analyzed (default is 12). Requires adding -s flag to the syntax. |
| min-password-length | STRING | --min-pass | Specifies the minimum password length to be analyzed (default is 8). Requires adding -s flag to the syntax. |
| password-complexity | STRING | --pass-complex | Specifies the edge of password complexity between 1 (trivial passwords) to 9 (very complex passwords) (default is 8). Requires adding -s flag to the syntax. |
| enge-of-high-entropy | STRING | --entropy | Specifies the edge of high entropy (default is 4.3). |
example
# scan a folder for keys and passwords at typical key lengthdumpsterdiver -p ./data -s --level 1 --entropy 4.3 --exclude-files .pdf .pngAnalyzing ./data ...[+] High entropy string (level 1) File: ./data/config/deploy.env:14 Entropy: 4.72 Length: 40[+] High entropy string (level 1) File: ./data/scripts/backup.sh:31 Entropy: 4.51 Length: 44[+] Password candidate (-s) File: ./data/app/settings.py:88 Complexity: 8[*] 3 findings across 2 filesguidance
Use dumpsterdiver to sweep mixed file trees for hardcoded secrets when the exact key format is unknown. Prefer dora for regex-matched API keys with exploitation hints. Prefer bandit for Python-specific source analysis.
Regex-based API key discovery with exploitation methods. dumpsterdiver leans on entropy and custom rules for broader coverage.
Security static analysis for Python source. dumpsterdiver is language-agnostic secret hunting across raw files.
faq
related
AST-based security checks for Python source.
Detect hardcoded secrets in git repos and plain directories.
Go AST security scanner for credentials, crypto, and injection.
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
Static analysis with rules that look like the code they match.
Hunt leaked credentials and verify which still work.
A folder of files feeds DumpsterDiver, which runs entropy and rule analysis over them and writes the discovered secrets as a queryable output.
Facts on this page come from the live Trickest tool library.