MOHAMMAD SAQLAIN mrrootsec

GitHub Search Syntax for Finding API Keys/Secrets/Tokens

As a security professional, it is important to conduct a thorough reconnaissance. With the increasing use of APIs nowadays, it has become paramount to keep access tokens and other API-related secrets secure in order to prevent leaks. However, despite technological advances, human error remains a factor, and many developers still unknowingly hardcode their API secrets into source code and commit them to public repositories. GitHub, being a widely popular platform for public code repositories, may inadvertently host such leaked secrets. To help identify these vulnerabilities, I have created a comprehensive search list using powerful search syntax that enables the search of thousands of leaked keys and secrets in a single search.

Search Syntax:

(path:*.{File_extension1} OR path:*.{File_extension-N}) AND ({Keyname1} OR {Keyname-N}) AND (({Signature/pattern1} OR {Signature/pattern-N}) AND ({PlatformTag1} OR {PlatformTag-N}))

Examples:

**1.

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Some notes and tools for reverse engineering / deobfuscating / unminifying obfuscated web app code.

Useful Regex Patterns to Find Vulnerabilities in Java Code

1. Hardcoded Credentials / Secrets

These patterns look for sensitive information directly embedded in the code.

Generic Passwords / Secrets / Tokens:
- Regex:

	#! /usr/bin/python3

	import http.server
	import sys
	import random
	import string
	import argparse
	import socket
	import logging
	import signal

	Links:

	[Basic](javascript:alert('Basic'))
	[Local Storage](javascript:alert(JSON.stringify(localStorage)))
	[CaseInsensitive](JaVaScRiPt:alert('CaseInsensitive'))
	[URL](javascript://www.google.com%0Aalert('URL'))
	[In Quotes]('javascript:alert("InQuotes")')

	Images:

	// Revision 1 - originally developed by chatGPT for @irsdl
	// Revision 2 - improved by ChatGPT to be more efficient using Burp APIs!
	// Automatically updates the Cookie header in Burp Repeater requests using Set-Cookie values from responses. This Bambda CustomAction preserves all existing cookies and only updates or adds values when necessary — ensuring session continuity without overwriting unrelated cookies.

	// 1. Grab the request & response
	var request = requestResponse.request();
	var response = requestResponse.response();

	// 2. Pull any Set-Cookie cookies from the response
	var responseCookies = response.cookies();

	"""
	Script Name: download_top_wp_plugins.py
	Description: Downloads the latest version of the most popular WordPress plugins and unzips them into a directory. By default, downloads all plugins which have 100,000+ active installs and have been updated within the last 2 years.
	Author: Muhan Luo
	Date: 2026-04-05
	"""

	import requests
	import argparse
	import json