/secret-extraction

name: secret-extraction
description: |
  This skill activates when the user mentions "extract secrets", "find credentials",
  "hardcoded passwords", "API keys", "embedded keys", "connection strings", "tokens",
  "secret scanning", "credential extraction", "extract crypto keys", "private keys",
  "certificate extraction", "config extraction", "encryption keys", "AES key",
  "RSA key", "HMAC secret", "JWT secret", "bearer token", "OAuth token",
  "AWS access key", "Azure key", "GCP key", "cloud credentials", "database password",
  "admin password", "default credentials", "service account", "FLOSS", "stack strings",
  "obfuscated strings", "decoded strings", "string analysis", "binary strings",
  "base64 decode", "hex decode", "XOR decode", "entropy analysis", "high entropy",
  "embedded certificate", "PEM key", "PKCS", "keystore", "wallet address",
  "crypto wallet", "bitcoin address", "ethereum address", "extract URLs",
  "extract IPs", "C2 addresses", "callback URLs", "exfiltration endpoints",
  "registry keys", "file paths", "UNC paths", "findcrypt", "signsrch",
  "crypto constants", "magic bytes", "binwalk extract", "firmware secrets",
  "PE resources secrets", "ELF sections", ".rodata secrets", "resource extraction",
  "anti-analysis bypass", "deobfuscate", "decrypt config", "decode payload",
  "RC4 decrypt", "XOR brute force", "string decryption routine", "unpacked strings",
  "credential harvesting from binary", "secret in binary", "sensitive data in executable",
  "password in firmware", "key material", "symmetric key", "asymmetric key",
  "initialization vector", "IV extraction", "salt extraction", "YARA crypto",
  "find secrets in malware", "credential dumping", "embedded config",
  "configuration block", "hardcoded URL", "API endpoint extraction",
  "Slack token", "GitHub token", "Stripe key", "SendGrid key", "Twilio key",
  "Firebase key", "Telegram bot token", "Discord token", "npm token",
  "PyPI token", "NuGet key", "Docker registry token", "Kubernetes secret",
  "HashiCorp Vault token", "Artifactory token", "LDAP password",
  "SMTP credentials", "S3 bucket credentials", "SAS token",
  "password hash", "NTLM hash", "shadow file", "passwd extraction",
  or discusses finding sensitive data, credentials, keys, or secrets in compiled
  binaries, firmware, or executables.
version: 2.0.0

Secret & Credential Extraction

Extract hardcoded credentials, API keys, cryptographic material, certificates, configuration secrets, and sensitive data from compiled binaries. This skill covers the full pipeline: string extraction, pattern matching, entropy analysis, crypto identification, format-specific extraction, and anti-analysis bypass.

Why This Matters

Hardcoded secrets in binaries are among the highest-impact findings in both penetration testing and malware analysis. A single embedded AWS key grants cloud access. A hardcoded database password opens the entire backend. An extracted C2 encryption key lets you decrypt all traffic. Developers embed secrets assuming compilation hides them -- it does not.

Methodology Overview

Execute these phases in order. Each phase feeds the next.

Phase 1 — Triage and Hash

Before touching strings, identify what you have. File type determines extraction strategy.

file <binary>
sha256sum <binary>
node ${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js hash <binary>

Record the hash. Check if this binary was already analyzed:

node ${CLAUDE_PLUGIN_ROOT}/scripts/analysis-tracker.js check <sha256> string-extraction

Phase 2 — Static String Extraction

Extract all readable strings. Start broad, then filter.

# ASCII strings, 6+ chars (reduces noise vs default 4)
strings -a -n 6 <binary> > strings_ascii.txt

# UTF-16 LE (Windows wchar_t, most common for Windows binaries)
strings -a -n 6 -el <binary> > strings_utf16.txt

# Combine and deduplicate
cat strings_ascii.txt strings_utf16.txt | sort -u > strings_all.txt

Count and triage:

wc -l strings_all.txt
# < 500 lines: review manually
# 500-5000: filter with patterns below
# > 5000: use targeted extraction only

Phase 3 — Obfuscated String Recovery

FLOSS recovers strings that `strings` cannot see: stack-built strings, tight loops, and runtime-decoded strings. This is where the real secrets hide.

# Full analysis (slow but thorough)
floss <binary>

# Stack strings only (fast, catches char-by-char construction)
floss --only stack <binary>

# Decoded strings (emulation-based, slowest, highest value)
floss --only decoded <binary>

# JSON output for automated processing
floss -j <binary> > floss_output.json

Phase 4 — Pattern Matching

Apply regex patterns to extracted strings. See `references/credential-patterns.md` for the full pattern library.

**Critical patterns to always check:**

# Cloud provider keys
grep -E 'AKIA[0-9A-Z]{16}' strings_all.txt              # AWS Access Key
grep -E 'AIza[0-9A-Za-z_-]{35}' strings_all.txt          # GCP API Key
grep -E 'AZURE[A-Za-z0-9+/=]{30,}' strings_all.txt       # Azure tokens

# Authentication
grep -iE '(password|passwd|pwd)\s*[=:]\s*\S+' strings_all.txt
grep -E 'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.' strings_all.txt  # JWT
grep -iE 'bearer\s+[A-Za-z0-9_\-\.]+' strings_all.txt

# Connection strings
grep -iE '(mysql|postgres|mongodb|redis)://[^"'\'']+' strings_all.txt
grep -iE 'Server=.*;.*Password=' strings_all.txt

# Private keys
grep -E 'BEGIN.*(PRIVATE KEY|RSA|EC|DSA|OPENSSH)' strings_all.txt

# API tokens (service-specific)
grep -E 'xox[bpsar]-[0-9a-zA-Z-]+' strings_all.txt       # Slack
grep -E 'ghp_[0-9a-zA-Z]{36}' strings_all.txt             # GitHub PAT
grep -E 'sk_live_[0-9a-zA-Z]{24,}' strings_all.txt        # Stripe

Phase 5 — Entropy Analysis

High-entropy regions indicate encrypted data, compressed payloads, or embedded keys. Entropy above 7.5 bits/byte in a data section signals crypto material or packed content.

# Section-level entropy (radare