skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hardcoded-credential-hunt

Scan HTML, JavaScript, and API responses for hardcoded credentials.

3|1|Updated Jul 2, 2026
Search Tags:#security#vulnerability#api#credentials#pentest#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hardcoded-credential-hunt-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hardcoded-credential-hunt
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/hardcoded-credential-hunt
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hardcoded-credential-hunt-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, python3.

What problem does it solve?

This skill identifies security vulnerabilities where sensitive credentials are inadvertently exposed in client-side code, configuration endpoints, or debug pages, allowing attackers to bypass authentication mechanisms.

Core Features & Use Cases

  • Credential Discovery: Scans HTML, JavaScript, and JSON responses for hardcoded passwords, API keys, and secret tokens.
  • Vulnerability Validation: Provides a structured procedure to verify if discovered credentials grant unauthorized access to protected endpoints.
  • Use Case: During a security assessment, use this skill to audit a target's configuration API or debug error pages to ensure no master passwords or secret keys are leaked to unauthenticated users.

Quick Start

Use the hardcoded-credential-hunt skill to scan the target URL for exposed secrets in HTML forms and configuration endpoints.

Frequently Asked Questions about hardcoded-credential-hunt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hardcoded credentials and API keys leaked in HTML and JavaScript?▼

To find hardcoded credentials in HTML and JavaScript, you scan web application responses, debug pages, and configuration endpoints using automated reconnaissance to detect exposed passwords, API keys, and secret tokens.

What is the best way to scan API configuration endpoints for exposed secret tokens?▼

Scanning API configuration endpoints for exposed secret tokens involves requesting unauthenticated responses and analyzing the HTML, JavaScript, and JSON payloads to identify inadvertently leaked sensitive credentials.

Does this hardcoded credential scanning require curl and python3 to run?▼

Yes, performing this automated reconnaissance and authentication bypass testing for exposed credentials requires both curl and python3 to be installed in your operating environment to fetch and analyze responses.

How do I verify if discovered API keys grant unauthorized access to protected endpoints?▼

To verify if discovered API keys grant unauthorized access, you perform structured authentication bypass testing by applying the extracted credentials against protected endpoints to validate if they successfully bypass access controls.

Can I use this approach to audit debug error pages for master passwords during a pentest?▼

Yes, during a security assessment or pentest you can audit target debug error pages and configuration APIs to ensure no master passwords or sensitive secret keys are leaked to unauthenticated users.

What types of sensitive secrets can be uncovered in client-side source code?▼

Uncovering sensitive secrets in client-side source code targets hardcoded passwords, API keys, and secret tokens inadvertently exposed within HTML, JavaScript, and JSON configuration responses.

Related Skills

Explore More Software Engineering Skills→
cmndcntrlcybercmndcntrlcyber
3

hunt-http-smuggling

Detect HTTP request smuggling vulnerabilities by analyzing header parsing inconsistencies.

Community
Advanced
Q16GQ16G
83

unauthorized-access

Verify protected endpoints enforce authentication for unauthenticated users.

Community
Advanced
Bsh13lderBsh13lder
4

web2-recon

Enumerate subdomains, verify live hosts, collect URLs, and scan for vulnerabilities.

Community
Intermediate
zhangzhang-111-izhangzhang-111-i
2

env-secrets-manager

Scan repositories for environment variable and secret leaks.

Community
Intermediate