Welcome back, cyberwarriors! 

You’ve probably seen people committing their env files to GitHub without noticing it. When you’re looking for a job as a coder, that mistake alone is significant enough to get you rejected if it happens during the technical portion. And if it ever happened to you, it’s happened to plenty of others too.

Today we’ll look at TruffleHog. It’s a tool that scans Git repositories and their full history for secrets that got committed by accident. It uses high entropy checks with custom regular expressions to catch strings that look like API keys, tokens, passwords and other sensitive data. You can point it at one repository or use a GitHub or GitLab API to hit a lot of projects in one go.

A developer can delete a key from the latest commit, but it will still live in Git’s past. With those credentials, you access services without making much noise.

Installation

First install git-dumper and TruffleHog. The Python package and the GitHub release are not the same, so pay attention to which one you’re on.

kali > pip3 install git-dumper  
kali > pip3 install trufflehog

We’ll use git-dumper when we find an exposed .git directory and then run TruffleHog against that dump. Leaked .git folders are still common.

Dump a Repository

Some servers leave the entire .git directory open. Below you can see a website where it was fully accessible.

Dump it by giving git-dumper the URL and a local folder for the files.

kali > git-dumper http://example.com/.git dump

Other websites block the directory listing but still serve some of the files.

Git-dumper can pull every object, commit and reference it can reach.

kali > git-dumper http://example.com/.git/  dump

Everything will be stored in the dump folder.

Analyzing the Repositories

Once the dump is on disk, run TruffleHog against it. By default it runs entropy-based matching. That can help, but it shouldn’t be the only mode you know. In our case, regex with entropy off gave us more results. 

kali > trufflehog --regex --entropy NO dump

In one of the files we found database credentials.

You can also install TruffleHog from the GitHub release and scan the filesystem directly:

kali > curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin 

kali > trufflehog filesystem /home/kali/Documents/dump  

This build is fine for tuning your scans, but it often makes more noise and false positives, so just be aware of it.

Other Ways to Analyze Repositories

Depending on which build you’re using, try these flags to change what you get in the output.

Scan a repo for verified secrets:

kali > trufflehog git https://github.com/trufflesecurity/test_keys --results=verified,unknown

Verified means TruffleHog checked these finding live against the service API (AWS, GitHub and so on). Unknown is both high entropy and regex hits that it couldn’t confirm.

Same scan with JSON output:

kali > trufflehog git https://github.com/trufflesecurity/test_keys --results=verified,unknown --json

Scan a GitHub repo including issues and pull requests:

kali > trufflehog github --repo=https://github.com/trufflesecurity/test_keys --issue-comments --pr-comments  

That digs into issues, comments, PR bodies and comments. You can find leaks in discussions too.

Scan a local Git repo:

kali > trufflehog git file://test_keys --results=verified,unknown  

Useful when you’ve compromised a dev Linux machine with multiple projects on it. There’s a better chance of finding something locally than pushed to GitHub, although both can happen, as you now know.

Summary

We had an external pentest where several services were accessible but no credentials could be found. Surprisingly, some developers had kept projects they were doing for the company publicly accessible on GitHub. Eventually we found a working pair and got into a database.

TruffleHog can be really helpful here. Sensitive files sometimes get exposed without the publisher even knowing it. We’re humans and we make mistakes. Offensive or defensive, the point is the same.

The post Open Source Intelligence (OSINT): Finding Leaked Secrets with TruffleHog first appeared on Hackers Arise.

Welcome back, cyberwarriors!

Lately we’ve been seeing more reports on attacks against industrial facilities. It’s often the case that the hardware behind these facilities has been vulnerable and overlooked for years. Administrators may know how to set these systems up and keep them running, but they don’t know how to secure them. So many SCADA/ICS/OT systems are reachable from the internet, and basically anyone can interact with them.

There are plenty of tools out there built to test specific functions of SCADA systems, but SCADAver seems to pack a lot more features into just one tool. That’s why we’ll cover it today.

SCADAver

SCADAver is a new tool written in Rust. It came out recently. The tool can discover, fingerprint, enumerate and test systems across common industrial protocols. In one binary you get a CLI interface, a terminal UI and a browser UI.

This project is still experimental. It’s built from public protocol documentation, vulnerability advisories and security research. It works pretty well for assessing device security internally, but you can also use it against devices reachable from the internet, since plenty of them are insecure. And it’s not just active interaction either, SCADAver supports PCAP file analysis too. The tool can also set up a rogue device you can test safely.

Setting Up

We’ll go with the quickest route and just download the compiled version. The developer has it available for Windows, macOS and Linux.

ubuntu > curl https://github.com/Whispergate/SCADAVER/releases/download/v1.5.1/scadaver-linux-x86_64

ubuntu > mv scadaver-linux-x86_64 scadaver
ubuntu > mv scadaver /usr/bin

Working with SCADAver

We’ll mainly be using the CLI version throughout the demonstration, though the terminal UI and browser UI will get shown too. The CLI version will probably be the most convenient for a lot of you.

First let’s list the help menu and see what the tool has:

ubuntu > scadaver -h 

As you can see, we’ve got commands here. Each command has its own help menu where you’ll find more information on exploits and other flags. You’ll see it later.

Siemens S7 – Basics 

Let’s do a basic scan of a Siemens system and see what the tool comes back with.

# a basic scan 
ubuntu > scadaver -i IP scan

# a stealthy scan
ubuntu > scadaver -z -i IP scan

It found port 102 open, and it was Siemens indeed.

We can also do a protocol specific scan or point it at a custom port if necessary:

ubuntu > scadaver -z -i IP --protocol siemens scan

# or with a custom port 
ubuntu > scadaver -z -p 105 -i IP --protocol siemens scan 

Port scanning is also possible. That’ll come in handy when you’re working internally and sweeping networks to find SCADA systems.

ubuntu > scadaver run portscan -i IP

Having covered the basics, we can move on to more interesting stuff and pull some information off this system.

Siemens S7 – Extracting Values

SCADAver can fetch every switch that’s currently on or off on the system. Having a map with human readable labels really helps here, that way you’ll know what each switch is actually responsible for (pump running, valve closed and so on).

ubuntu > scadaver -i IP get io

Say you know a pump is running, now you can find out exactly how it’s supposed to run. We do that with get db, which extracts memory chunks from the device.

ubuntu > scadaver -i IP get db 1 0 64

Here we ask it to open Data Block 1, start at byte 0, and read 64 bytes. Just like with get io, we need a symbol table or the program itself to understand what these values mean. With a symbol table, we’d know that if DB1 holds 1500, the program wants 1500 rpm, for example.

Modbus – Changing Values

We’re not limited to reading only, we can set our own values for registers and coils too. Here are some examples:

ubuntu > scadaver -i IP -p 502 set register 1 1234
ubuntu > scadaver -i IP -p 502 set registers 0 100,200,300,400
ubuntu > scadaver -i IP -p 502 set coil 5 on
ubuntu > scadaver -i IP -p 502 get register 1
ubuntu > scadaver -i IP -p 502 get coil 5 1

Between 2007 and 2010 Stuxnet leaned heavily on a highly sophisticated False Data Injection (FDI) attack to conceal its sabotage. The malware recorded 21 seconds of normal operational sensor readings from the centrifuges and looped that healthy operational data back to the Human Machine Interface (HMI) and the main controller.

We can pull this off too:

ubuntu > scadaver -i IP run fdi --address 100 --value 500 --count 20

With this command we keep writing the same number into one Modbus register, over and over. Many HMIs and programs read that register and trust it blindly. So the screen or the logic keeps seeing 500 even if the real process is doing something else entirely. 500 here could mean 500 rpm, 500 liters, or 50.0°C. Only the map tells you what it’s actually responsible for.

As you know, there can be several PLCs in one cabinet, and you need a way to know which one you’re working with. Schneider’s identify yourself packet (UDP 27127) makes many M340, M580, Quantum and Premium units blink an LED on the panel. It’s a harmless identity check.

ubuntu > scadaver -i IP run flash-led

These SCADA systems often have an HTTP web interface that you can access and interact with. Sometimes, it’s authentication gated and prompts you to enter valid credentials. Here’s another run command that’ll test default credentials against HTTP Basic Auth.

ubuntu > scadaver -i IP run default-creds

More exploits and actions that run has can be seen in the help menu:

ubuntu > scadaver run -h 

Another interesting thing you might find is the database knowledge behind researching and exploiting SCADA systems. We listed all of them for Siemens:

ubuntu > scadaver db refs siemens

Browser UI & Terminal UI

In case you don’t like working with the CLI, you can try the other options.

For the Terminal UI run this:

ubuntu > scadaver

And the Browser UI can be set up with this command: 

ubuntu > scadaver web

It will be hosted on http://127.0.0.1:8888

Summary

The developer calls it a unified ICS red team multi tool, and it truly is. It’s handy to have all these exploits and recon features packed into one tool that supports so many protocols and products. Obviously it’s still in active development, since it just came out. But even so, you can already put it to use instead of switching between different tools.

We haven’t covered all its features and functions, that would make this far too long. Feel free to experiment with it yourself, since it can even set up a rogue server for you to test against.

If you want to learn how to hack and secure SCADA systems, we invite you to our training led by OccupyTheWeb. It’s available for both beginners and advanced students.

The post SCADA/ICS/OT Hacking and Security: Hacking with SCADAver first appeared on Hackers Arise.

Welcome back, cyberwarriors!

When you just land on a new machine, you often have to sit down and go through every running service just to figure out what’s actually installed and which of those apps might be worth a closer look for credentials in a config somewhere. You can’t skip this part, as it usually gives you something you’ll need later in the engagement, but it eats time. A lot of it.

There are older tools that try to do something similar, but the two we’re covering today are more current. LOLCreds and CredsHound come from the same developer and they cover a huge amount of software.

So let’s see how they work.

LOLCreds

LOLCreds is a website that has 678 different credentials. Some software generates a password when you install it or prompts you to enter it. There are also static credentials that are baked into the product. The D-Link backdoor credentials are a good example of the second kind. 

LOLCreds also tracks AI API keys and shows you exactly where to find them on a system. Here’s what it has on Cursor.

MySQL is a more basic example. Its password is often hidden in a config file or sitting as a variable in the env file.

CredsHound

All of that is great when you already know what software you’re hunting through and you’re picking it one at a time. But machines might have dozens of applications running. Software can be removed, but configs stay and password reuse is common. You can use CredsHound for this hunt. 

CredsHound is a scanner written in Go. Under the hood it pulls templates from LOLCreds so it can run product aware checks. It has been fully optimized for modern environments, so it will scan everything from DBeaver encrypted databases to OpenCode, GitHub Copilot CLI, Hugging Face, OpenAI and more. 

Setting Up

Before you start using the scanner, you need to have Go installed.

bash$ > sudo apt install golang
bash$ > go install github.com/haxxm0nkey/credshound/cmd/credshound@latest

Once that finishes, you may run into a common issue where the Go binaries aren’t included in your system path yet. Add them yourself:

bash$ > sudo echo “export PATH:$PATH:/home/user/go/bin” >> /etc/profile
bash$ > source /etc/profile

Now we’re ready.

How to Use

There are different ways you can run it, but you always start with updating the template library. The scanner can be used with different privileges, but we’ll use root. 

# Update templates 
bash# > credshound -ut

# Scan /etc 
bash# > credshound -t /root/.cache/credshound/templates /etc

Our system is fresh, so there’s not much on it yet. A box that’s been sitting in prod for a while will have more interesting results, like the one below.

CredsHound can also work with BloodHound to show you the relationships between credentials as a graph. Here’s how to set it up:

ubuntu$ > credshound -t ~/lolcreds-templates -bloodhound -o credshound-bloodhound.json .

Then you import the JSON file into BloodHound and see what comes up.

When you’ve collected many of these JSON files from different machines, you’ll start seeing the architecture of what you’re testing.

A few more commands you’ll find useful:

# Scan the current directory
bash$ > credshound .

# Scan multiple roots
bash$ > credshound ~/project /etc

# Scan only env variables
bash$ > credshound -sources env

# Scan current and process environment variables on Linux
bash$ > credshound -sources env,proc

Summary

Credential hunting is a tedious thing when you do it manually, but you can’t really skip this part. It’s essential to move further. The tools covered can make the whole process easier and the output rich. LOLCreds has a reference library for different products and CredsHound can scan your hosts for secrets with results that you may import into BloodHound.

If you like red teaming, we have our Red Team Operator training, where we cover more tools and techniques to help you emulate real APT work, so you can give a company a realistic stress test and help make it secure.

The post Pentesting: Stealing Credentials with LOLCreds and CredsHound first appeared on Hackers Arise.

EvilTokens phishing hides takeover clues until browser execution leaving SOC teams needing deeper visibility to validate threats faster and reduce account risk.