/secrets

description: Focused secret and credential extraction from a binary
allowed-tools: Bash, Read, Write, Glob, Grep
argument-hint: <path-to-binary>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Secret & Credential Extraction

Parse `$ARGUMENTS` to get the binary path.

Step 1 — Hash & Validate

node "${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js" hash "$ARGUMENTS"

Step 2 — String Extraction

Run both ASCII and Unicode extraction:

strings -a -n 6 <binary>              # ASCII strings (min 6 chars)
strings -a -n 6 -el <binary>          # UTF-16 LE strings

Step 3 — Obfuscated Strings

floss <binary>                          # FLARE Obfuscated String Solver

FLOSS will extract stack strings, tight strings, and decoded strings that `strings` misses.

Step 4 — Pattern Matching

Apply regex patterns to all extracted strings:

| Pattern | Type | Example | |---------|------|---------| | `https?://[^\s"']+` | url | `http://c2.evil.com/beacon` | | `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}` | ip | `192.168.1.100` | | `AKIA[0-9A-Z]{16}` | api-key | AWS Access Key | | `AIza[0-9A-Za-z_-]{35}` | api-key | GCP API Key | | `eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+` | token | JWT Token | | `[a-zA-Z0-9+/]{40,}={0,2}` | credential | Base64 encoded blob | | `-----BEGIN .* KEY-----` | crypto-key | PEM private key | | `HKEY_(LOCAL_MACHINE\|CURRENT_USER)\\.*` | registry-key | Registry path | | `[13][a-km-zA-HJ-NP-Z1-9]{25,34}` | wallet | Bitcoin address | | `password\s*[=:]\s*\S+` | credential | Hardcoded password | | `(user\|admin\|login)\s*[=:]\s*\S+` | credential | Username/credential | | `Data Source=.*` | credential | Connection string |

Step 5 — Base64 Decode

For each base64 blob found, decode and inspect:

echo "<blob>" | base64 -d 2>/dev/null

Look for decoded URLs, commands, scripts, or binary data.

Step 6 — Log Findings

For each unique finding:

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" add "<binary>" "<type>" "<value>" "<severity>" "<title>"

Severity guidelines:

• **CRITICAL**: Private keys, admin credentials, database connection strings
• **HIGH**: API keys, JWT tokens, C2 URLs
• **MEDIUM**: Internal URLs, IP addresses, email addresses
• **LOW**: File paths, registry keys, generic strings
• **INFO**: Base64 blobs, encoded data

Step 7 — Report

Save findings report to `secrets-<binary-name>.md`.