10

One of requirements I have in my work is that passwords cannot be hardcoded in source code, database dumps, scripts, etc.

However, scanning all this stuff manually and repeatedly gets tedious. Is there anything "off the shelf" that looks for password-like keywords and phrases in a file?

Sure, I can use grep with regex. But I'd prefer something that is custom-built for the task.

A very nice to have would be if it could search in a "fuzzy" manner instead of searching for fixed strings, searching for passwords, variables, database columns and content that resemble passwords or password locations.

Improve this question
4
  • The only chance is IMHO by searching for special patterns or the list of false positive will grow as the number of e.g. strings grow.
    – frlan
    Commented Mar 18, 2016 at 9:49
  • 1
    And if I don't call my variable password? If I code ingress = "letmein", how would your tool find that? I guess you can only dump all strings (which probably means your tool needs to be able to parse many coding languages). Or am I missing the point somehow?
    – Mawg
    Commented Mar 18, 2016 at 12:37
  • @Mawg: if a tool is as dumb as grep, why use it in the first place instead of grep? I expect something more "intelligent" than that.
    – LetMeSOThat4U
    Commented Mar 23, 2016 at 17:47
  • It occurs to me that you haven't told us whether you have a list of known passwords which you are searching for. When I first read this, I thought the password was supposed to look for anything that might be a password. Which is it, please?
    – Mawg
    Commented Nov 9, 2018 at 11:35

1 Answer 1

Reset to default
2

Sonar Secrets is a plugin to SonarQube. It can recognize passwords, API keys, AWS credentials, tokens, etc. from source code.

You can read a nice introduction to it in https://medium.com/@SkyscannerEng/introducing-sonar-secrets-32e36e1bbc97

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.