From code vulnerability aspect, idea is to detect password embedded in source code(C, C++, Java, whatever)

Problem is, password can be of any pattern.

How to approach in detecting a password within source code?

  • If the password can be any pattern then this isn't really possible (unless of course the code has a section titled "passwd" or similar) – Rory Alsop May 29 '19 at 16:29
  • @RoryAlsop How does tool like veracode help detect? – overexchange May 29 '19 at 17:51
  • @overexchange Never used this tool, but to repeat Rory Alsop: If you have no criterias on what you are searching, you won't find it. You need to know what you want to find. Bei it syntactical (Password=...), based on entropy (for properly random things), human-letter things that are not recognizable words (for humanly-random letter combinations), or whatever. – deviantfan May 29 '19 at 20:13
  • Code reviews, maybe? – Fund Monica's Lawsuit Jul 5 '19 at 14:43

There are existing tools that do this to some extent. It helps if you can scope what you're looking for (API keys, base64 encoded AES keys, etc)

TruffleHog https://github.com/dxa4481/truffleHog

Yelp's detect-secrets https://github.com/Yelp/detect-secrets

DevSkim running in application mode can also work for this with appropriately configured rules. https://github.com/microsoft/DevSkim

This is a difficult problem to solve algorithmically. New tools pop up now and then, keeping up on the tool ecosystem would be wise if you are trying to prevent secrets being introduced on an enterprise scale.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.